Add Domain to types.Host
- Dominant language
- Go
- Stars
- 405
- Forks
- 91
- PR merge metrics
- No merged PRs in 30d
Description
Add a `Domain` Field to the `types.Host` struct. For Windows this should be populated with the host's Active Directory (AD) or Entra ID domain name. This value should satisfy the definition of the `host.domain` field in ECS.
### Windows registry data sources
- _For Active Directory_ - `HKLM:SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Group Policy\\State\\Machine` and read `Distinguished-Name`
- This is the distinguished name (DN) of the Active Directory that the local computer is associated with for the purposes of Group Policy. It typically follows a format like `CN=ComputerName,OU=Computers,DC=domain,DC=com`. I think we would join together the `DC` components to form the domain name.
- _For Entra ID_ - `HKLM:SYSTEM\\CurrentControlSet\\Control\\CloudDomainJoin\\JoinInfo\\`
- Iff `JoinInfo` contains one entry then get the `UserEmail` value from within that entry and then parse the domain from the email address. If JoinInfo contains more than one entry then the computer is joined to more than one domain so do nothing.
### References
- [ECS host.domain](https://www.elastic.co/guide/en/ecs/current/ecs-host.html#field-host-domain)
- https://nerdymishka.com/articles/azure-ad-domain-join-registry-keys/
Contributor guide
Research direction
Start by locating the types.Host struct and the Windows system-information code that populates host fields. Review the specified Group Policy and CloudDomainJoin registry paths, then verify the AD Distinguished-Name and single-entry Entra ID cases against the ECS host.domain definition. Done means types.Host exposes Domain and Windows populates it under the stated conditions.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- go
- Domain
- operating-systems
- Issue type
- Feature
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 38/100