elastic / elastic/integrations
[Bug] Azure integration missing event.category across events
- Dominant language
- Handlebars
- Stars
- 333
- Forks
- 647
- Avg merge
- 3d 4h
- Merged PRs (30d)
- 209
Description
## Summary
Azure integration has missing `event.category` for below events. This is a required ECS field for Elastic Security and its absence breaks EQL-based threat detection rules.
## Current behavior
`event.category` is not populated on a significant subset of events ingested by the azure integration. This causes EQL detection rules that filter on `event.category` to silently miss matching events, reducing detection coverage.
### Environment
Azure Logs v1.36.1
- azure.auditlogs
- azure.eventhub
- azure.activitylogs
### Additional Notes
More context: https://github.com/elastic/integrations/issues/18343
Contributor guide
Research direction
Start by inspecting the azure.auditlogs, azure.eventhub, and azure.activitylogs event mappings for the affected events. Compare their output with the ECS requirement for event.category and verify that EQL-based detection rules no longer miss events once the field is populated across the listed integrations.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- azure, handlebars
- Domain
- cloud, security
- Issue type
- Bug
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Quiet
- Clarity
- Mostly clear
- Newbie friendliness
- 55/100