elastic / elastic/integrations

[New Integration] PingDirectory

Open
#19,103 5 comments 0 reactions 1 assignee Claimed by @muskan-agarwal26 View on GitHub
9.6 candidate Epic New Integration Team:Security-Service Integrations
Dominant language
Handlebars
Stars
333
Forks
647
Avg merge
3d 4h
Merged PRs (30d)
209

Description

**Summary**
Create a PingDirectory integration that ingests LDAP access, HTTP access, and audit log data, and periodically queries the directory for user and group entity data, to enable identity security monitoring, directory audit visibility, and entity store enrichment in Elastic.

**Data architecture**
This integration has two distinct data motions:
**Track 1 — Event stream (log based)**
Ingest the three PingDirectory log types via Filebeat or Elastic Agent. Each log type produces a separate data stream.

**Track 2 — Directory entity sync (LDAP query-based, periodic)**
Periodically query the directory for user objects and group membership to populate the Elastic entity store -without this track we miss our on the entity analytics use case. These attributes must be mapped to the relevant [ECS Entity Fields](https://www.elastic.co/docs/reference/ecs/ecs-entity). Example user attributes include uid, cn/displayName, mail, sn/givenName, employeeType, title, department, ou, manager, isMemberOf, isDirectMemberOf, ds-pwp-account-disabled, ds-pwp-locked-out, passwordExpirationTime, ds-create-time, and ds-update-time.

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.