elastic / elastic/docs-content
[Internal]: Document Service entity creation criteria in Entity Analytics docs
- Dominant language
- No language data
- Stars
- 47
- Forks
- 261
- Avg merge
- 3d 12h
- Merged PRs (30d)
- 116
Description
**Problem:**
The [entity store creation criteria](https://www.elastic.co/docs/solutions/security/advanced-entity-analytics/entity-store#entity-store-creation-criteria) docs don't currently cover Service entities. Unlike User and Host, a Service entity's EUID is computed from `service.name` alone (`service:`), and that's undocumented.
**Desired outcome:**
- Add Service entities to the creation-criteria section, documenting the EUID formula: `service:`.
- Note that, unlike User/Host, there's currently no additional resolution logic beyond `service.name` — this is kept for backward compatibility so entities created in pre-9.4 versions aren't lost on upgrade.
**Optional:**
Perhaps call out the known trade-off: several integrations populate `service.name` from a fallback field rather than an actual service identifier (e.g. the Kubernetes integration falls back to `kubernetes.container.name`), which can produce a larger volume of lower-confidence Service entities compared to User/Host.
Contributor guide
No contributing guide indexed for this repository
Assessment
This issue has not been assessed yet.