elastic / elastic/docs-content

[Internal]: Document Service entity creation criteria in Entity Analytics docs

Open
#8,259 1 comment 0 reactions 1 assignee Claimed by @natasha-moore-elastic View on GitHub
Team:SKI
Dominant language
No language data
Stars
47
Forks
261
Avg merge
3d 12h
Merged PRs (30d)
116

Description

**Problem:**
The [entity store creation criteria](https://www.elastic.co/docs/solutions/security/advanced-entity-analytics/entity-store#entity-store-creation-criteria) docs don't currently cover Service entities. Unlike User and Host, a Service entity's EUID is computed from `service.name` alone (`service:`), and that's undocumented.

**Desired outcome:**
- Add Service entities to the creation-criteria section, documenting the EUID formula: `service:`.
- Note that, unlike User/Host, there's currently no additional resolution logic beyond `service.name` — this is kept for backward compatibility so entities created in pre-9.4 versions aren't lost on upgrade.

**Optional:**
Perhaps call out the known trade-off: several integrations populate `service.name` from a fallback field rather than an actual service identifier (e.g. the Kubernetes integration falls back to `kubernetes.container.name`), which can produce a larger volume of lower-confidence Service entities compared to User/Host.

Contributor guide

No contributing guide indexed for this repository

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.