elastic / elastic/integrations
[New Integration] PingDirectory
- Dominant language
- Handlebars
- Stars
- 333
- Forks
- 647
- Avg merge
- 3d 4h
- Merged PRs (30d)
- 209
Description
**Summary**
Create a PingDirectory integration that ingests LDAP access, HTTP access, and audit log data, and periodically queries the directory for user and group entity data, to enable identity security monitoring, directory audit visibility, and entity store enrichment in Elastic.
**Data architecture**
This integration has two distinct data motions:
**Track 1 — Event stream (log based)**
Ingest the three PingDirectory log types via Filebeat or Elastic Agent. Each log type produces a separate data stream.
**Track 2 — Directory entity sync (LDAP query-based, periodic)**
Periodically query the directory for user objects and group membership to populate the Elastic entity store -without this track we miss our on the entity analytics use case. These attributes must be mapped to the relevant [ECS Entity Fields](https://www.elastic.co/docs/reference/ecs/ecs-entity). Example user attributes include uid, cn/displayName, mail, sn/givenName, employeeType, title, department, ou, manager, isMemberOf, isDirectMemberOf, ds-pwp-account-disabled, ds-pwp-locked-out, passwordExpirationTime, ds-create-time, and ds-update-time.
Contributor guide
Assessment
This issue has not been assessed yet.