Skip to content

entityanalytics_{ad,entra_id,okta}: add agentless deployment mode and minimal-state sync#20212

Draft
efd6 wants to merge 1 commit into
elastic:mainfrom
efd6:19499-entity_analytics
Draft

entityanalytics_{ad,entra_id,okta}: add agentless deployment mode and minimal-state sync#20212
efd6 wants to merge 1 commit into
elastic:mainfrom
efd6:19499-entity_analytics

Conversation

@efd6

@efd6 efd6 commented Jul 20, 2026

Copy link
Copy Markdown
Contributor

Proposed commit message

entityanalytics_{ad,entra_id,okta}: add agentless deployment mode and minimal-state sync

Enable agentless deployment for all three entity analytics packages by
bumping format_version to 3.3.2, adding deployment_modes to the policy
templates, and introducing a use_minimal_state configuration variable
(default true, hidden from users in both deployment modes).

Existing system tests are pinned to use_minimal_state: false to keep
them on the legacy sync path. New script tests verify the minimal-state
path routes entities to per-type data streams (AD and EntraID). Okta
minimal-state script tests are blocked on elastic/beats#52061 (the
entcollect Okta provider hardcodes https:// but does not accept custom
TLS config, preventing testing against a self-signed mock).

The EntraID mock gains /v1.0/groups and /v1.0/groups/{id}/members
endpoints required by the entcollect provider's non-delta group fetch.

Checklist

  • I have reviewed tips for building integrations and this pull request is aligned with them.
  • I have verified that all data streams collect metrics or logs.
  • I have added an entry to my package's changelog.yml file.
  • I have verified that Kibana version constraints are current according to guidelines.
  • I have verified that any added dashboard complies with Kibana's Dashboard good practices

Author's Checklist

  • [ ]

How to test this PR locally

Related issues

Screenshots

@efd6 efd6 self-assigned this Jul 20, 2026
@efd6 efd6 added enhancement New feature or request Integration:entityanalytics_entra_id Microsoft Entra ID Entity Analytics Team:Security-Service Integrations Security Service Integrations team [elastic/security-service-integrations] Integration:entityanalytics_okta Okta Entity Analytics Integration:entityanalytics_ad Active Directory Entity Analytics Category: Entity Analytics labels Jul 20, 2026
@efd6
efd6 force-pushed the 19499-entity_analytics branch 2 times, most recently from bcf1da7 to 2e5ee6e Compare July 20, 2026 04:04
@github-actions

Copy link
Copy Markdown
Contributor

✅ Elastic Docs Style Checker (Vale)

No issues found on modified lines!


The Vale linter checks documentation changes against the Elastic Docs style guide. To use Vale locally or report issues, refer to Elastic style guide for Vale.

@elastic-vault-github-plugin-prod

elastic-vault-github-plugin-prod Bot commented Jul 20, 2026

Copy link
Copy Markdown
Contributor

🚀 Benchmarks report

To see the full report comment with /test benchmark fullreport

… minimal-state sync

Enable agentless deployment for all three entity analytics packages by
bumping format_version to 3.3.2, adding deployment_modes to the policy
templates, and introducing a use_minimal_state configuration variable
(default true, hidden from users in both deployment modes).

Existing system tests are pinned to use_minimal_state: false to keep
them on the legacy sync path. New script tests verify the minimal-state
path routes entities to per-type data streams (AD and EntraID). Okta
minimal-state script tests are blocked on elastic/beats#52061 (the
entcollect Okta provider hardcodes https:// but does not accept custom
TLS config, preventing testing against a self-signed mock).

The EntraID mock gains /v1.0/groups and /v1.0/groups/{id}/members
endpoints required by the entcollect provider's non-delta group fetch.
@efd6
efd6 force-pushed the 19499-entity_analytics branch from 2e5ee6e to 6718796 Compare July 20, 2026 05:24
@elastic-vault-github-plugin-prod

Copy link
Copy Markdown
Contributor

✅ All changelog entries have the correct PR link.

@infra-vault-gh-plugin-prod

Copy link
Copy Markdown

💚 Build Succeeded

History

cc @efd6

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

Category: Entity Analytics enhancement New feature or request Integration:entityanalytics_ad Active Directory Entity Analytics Integration:entityanalytics_entra_id Microsoft Entra ID Entity Analytics Integration:entityanalytics_okta Okta Entity Analytics Team:Security-Service Integrations Security Service Integrations team [elastic/security-service-integrations]

Projects

None yet

Development

Successfully merging this pull request may close these issues.

entity_analytics*: add agentless deployment mode and use_minimal_state config

1 participant