elastic / elastic/integrations

[Bug] Azure integration missing event.category across events

Open
#20,424 0 comments 0 reactions 0 assignees View on GitHub
Integration:azure Team:obs-ds-hosted-services Team:Obs-InfraObs
Dominant language
Handlebars
Stars
333
Forks
647
Avg merge
3d 4h
Merged PRs (30d)
209

Description

## Summary

Azure integration has missing `event.category` for below events. This is a required ECS field for Elastic Security and its absence breaks EQL-based threat detection rules.

## Current behavior
`event.category` is not populated on a significant subset of events ingested by the azure integration. This causes EQL detection rules that filter on `event.category` to silently miss matching events, reducing detection coverage.

### Environment
Azure Logs v1.36.1

- azure.auditlogs
- azure.eventhub
- azure.activitylogs

### Additional Notes
More context: https://github.com/elastic/integrations/issues/18343

Contributor guide

Open the contributing guide

Research direction

Start by inspecting the azure.auditlogs, azure.eventhub, and azure.activitylogs event mappings for the affected events. Compare their output with the ECS requirement for event.category and verify that EQL-based detection rules no longer miss events once the field is populated across the listed integrations.

Written by the indexing model from the issue text.

Assessment

Tech stack
azure, handlebars
Domain
cloud, security
Issue type
Bug
Difficulty
4/5
Estimated time
3-5 days
Activity status
Quiet
Clarity
Mostly clear
Newbie friendliness
55/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.