elastic / elastic/go-sysinfo

Add Domain to types.Host

Open
#212 2 comments 0 reactions 0 assignees View on GitHub
enhancement
Dominant language
Go
Stars
405
Forks
91
PR merge metrics
No merged PRs in 30d

Description

Add a `Domain` Field to the `types.Host` struct. For Windows this should be populated with the host's Active Directory (AD) or Entra ID domain name. This value should satisfy the definition of the `host.domain` field in ECS.

### Windows registry data sources

- _For Active Directory_ - `HKLM:SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Group Policy\\State\\Machine` and read `Distinguished-Name`
- This is the distinguished name (DN) of the Active Directory that the local computer is associated with for the purposes of Group Policy. It typically follows a format like `CN=ComputerName,OU=Computers,DC=domain,DC=com`. I think we would join together the `DC` components to form the domain name.
- _For Entra ID_ - `HKLM:SYSTEM\\CurrentControlSet\\Control\\CloudDomainJoin\\JoinInfo\\`
- Iff `JoinInfo` contains one entry then get the `UserEmail` value from within that entry and then parse the domain from the email address. If JoinInfo contains more than one entry then the computer is joined to more than one domain so do nothing.

### References

- [ECS host.domain](https://www.elastic.co/guide/en/ecs/current/ecs-host.html#field-host-domain)
- https://nerdymishka.com/articles/azure-ad-domain-join-registry-keys/

Contributor guide

Open the contributing guide

Research direction

Start by locating the types.Host struct and the Windows system-information code that populates host fields. Review the specified Group Policy and CloudDomainJoin registry paths, then verify the AD Distinguished-Name and single-entry Entra ID cases against the ECS host.domain definition. Done means types.Host exposes Domain and Windows populates it under the stated conditions.

Written by the indexing model from the issue text.

Assessment

Tech stack
go
Domain
operating-systems
Issue type
Feature
Difficulty
4/5
Estimated time
3-5 days
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
38/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.