Active Directory Entity Analytics

This Active Directory Entity Analytics integration allows users to securely stream User Entities data to Elastic Security via the Active Directory LDAP look-ups. When integrated with Elastic Security, this valuable data can be leveraged within Elastic for risk-scoring scenarios (e.g., context enrichments) and detecting advanced analytics (UBA) use cases.

In v0.15.0 of the integration the user and device data was split into separate data streams. The data ingested into your index will be the same but you may need to update device searches if you were using them.

The Active Directory Entity Analytics integration collects identity data.

• User is used to retrieve all user entries available from an Active Directory server.
• Device is used to retrieve all device entries available from an Active Directory server.
• Group contains standalone documents for Active Directory groups that have no direct members, collected when the Include empty groups option is enabled. Groups with members are already represented through membership enrichment on user and device entities.

Elastic Agent must be installed for standard deployments. For more details, check the Elastic Agent installation instructions.

Elastic Managed integrations are only supported on Elastic Cloud Serverless and Elastic Cloud Hosted deployments. An Elastic Managed integration lets you ingest data from a cloud source while avoiding the orchestration, management, and maintenance associated with standard ingest infrastructure. Elastic runs the collector for you, so you can focus on your data instead of the infrastructure that collects it. This functionality is in beta and is subject to change. Beta features are not subject to the support SLA of official GA features.

For more information, refer to Elastic Managed integrations and the Elastic Managed integrations FAQ.

Because the agent must still speak LDAP to an Active Directory server, the server must be reachable over the public internet on TCP port 636 (LDAPS). Plain LDAP on port 389 is not accepted in this configuration.

Elastic Managed deployment works with:

• Microsoft Entra Domain Services (Azure AD DS) — when the "Allow secure LDAP access over the internet" option is enabled on the managed domain, the domain is assigned a public IP address on port 636. See Configure secure LDAP for Microsoft Entra Domain Services for setup instructions. Elastic Managed integrations do not use a fixed range of egress IP addresses, so the secure LDAP endpoint must accept connections from the public internet; restrict access using the other controls Microsoft recommends, such as requiring a valid certificate and strong credentials.
• JumpCloud Cloud LDAP — ldap.jumpcloud.com:636 is a public endpoint and requires no additional configuration.
• Okta LDAP Interface — <org>.ldap.okta.com:636 is a public endpoint and requires no additional configuration.

Elastic Managed deployment does not work without additional network connectivity for:

• Traditional on-premises Active Directory domain controllers (not internet-exposed)
• AWS Managed Microsoft AD (VPC-internal only)
• Google Cloud Managed Microsoft AD (private network only)

For on-premises AD that is not internet-accessible, use standard agent-based deployment with an Elastic Agent running inside your network.

1. Obtain the LDAP username, for example CN=Administrator,CN=Users,DC=testserver,DC=local and password, and LDAP host address for the Active Directory server that you will be collecting data from.
2. Determine the Base DN for the directory to be used, for example CN=Users,DC=testserver,DC=local.

1. In Kibana navigate to Management > Integrations.
2. In the search bar, type Active Directory Entity Analytics.
3. Select the Active Directory Entity Analytics integration and add it.
4. While adding the integration, add the user, host and base DN details obtained above.
5. Save the integration.

The Active Directory provider periodically contacts the server, retrieves updates for users, devices, and groups, updates its internal cache of metadata, and ships updated records to Elasticsearch.

Fetching and shipping updates occurs in one of two processes: full synchronizations and incremental updates. Full synchronizations send the entire list of users, devices, and groups in state. Incremental updates send only records that changed since the last sync. Changes include metadata updates, additions, and deletions. By default, full synchronizations occur every 24 hours and incremental updates occur every 15 minutes. These intervals may be customized to suit your use case.

By default this integration uses minimal-state sync, which routes user, device, and group documents directly to the user, device, and group data streams. Existing policies are updated to use minimal-state sync on upgrade. Minimal-state sync requires Elastic Agent 9.5.0 or later; older agents use the legacy sync.

This integration provides an asset inventory, a point-in-time snapshot of which users and devices exist and their current properties. It does not provide an audit trail of who changed what, or when. If you need to track administrative changes to Active Directory objects, consider collecting Windows Security event logs (e.g., Event IDs 4720, 4722, 4738, 4743) via the System integration.

A user document:

{
    "@timestamp": "2024-02-05T06:37:40.876026-05:00",
    "activedirectory": {
        "id": "CN=Guest,CN=Users,DC=testserver,DC=local",
        "user": {
            "accountExpires": "2185-07-21T23:34:33.709551516Z",
            "badPasswordTime": "0",
            "badPwdCount": "0",
            "cn": "Guest",
            "codePage": "0",
            "countryCode": "0",
            "dSCorePropagationData": [
                "2024-01-22T06:37:40Z",
                "1601-01-01T00:00:01Z"
            ],
            "description": "Built-in account for guest access to the computer/domain",
            "distinguishedName": "CN=Guest,CN=Users,DC=testserver,DC=local",
            "instanceType": "4",
            "isCriticalSystemObject": true,
            "lastLogoff": "0",
            "lastLogon": "2185-07-21T23:34:33.709551616Z",
            "logonCount": "0",
            "memberOf": "CN=Guests,CN=Builtin,DC=testserver,DC=local",
            "name": "Guest",
            "objectCategory": "CN=Person,CN=Schema,CN=Configuration,DC=testserver,DC=local",
            "objectClass": [
                "top",
                "person",
                "organizationalPerson",
                "user"
            ],
            "objectGUID": "hSt/40XJQU6cf+J2XoYMHw==",
            "objectSid": "AQUAAAAAAAUVAAAA0JU2Fq1k30YZ7UPx9QEAAA==",
            "primaryGroupID": "514",
            "pwdLastSet": "2185-07-21T23:34:33.709551616Z",
            "sAMAccountName": "Guest",
            "sAMAccountType": "805306368",
            "uSNChanged": "8197",
            "uSNCreated": "8197",
            "userAccountControl": "66082",
            "whenChanged": "2024-01-22T06:36:59Z",
            "whenCreated": "2024-01-22T06:36:59Z"
        },
        "whenChanged": "2024-01-22T06:36:59Z"
    },
    "user": {
        "id": "CN=Guest,CN=Users,DC=testserver,DC=local"
    },
    "labels": {
        "identity_source": "activedirectory-1"
    }
}

This is the User dataset.

This is the Device dataset.

This is the Group dataset. It contains standalone documents for Active Directory groups that have no direct members, collected when the Include empty groups option is enabled. Groups with members are already represented through membership enrichment on user and device entities.