feat(stream): Microsoft 365 directory-audit event type and deserializer - #1603
Open
andriikachur wants to merge 7 commits into
Open
feat(stream): Microsoft 365 directory-audit event type and deserializer#1603andriikachur wants to merge 7 commits into
andriikachur wants to merge 7 commits into
Conversation
Additive support for Entra directory audit events entering the logs
pipeline via the generic message-type path:
- IntegratedToolType.MICROSOFT_365 ("microsoft-365")
- MessageType.MICROSOFT_365_AUDIT_EVENT -> CASSANDRA_EVENT_LOG + KAFKA_PINOT
- UnifiedEventType M365_* additions (RoleManagement/failures -> WARNING)
- EventTypeMapper mappings for Graph directoryAudits category values
- Microsoft365AuditEventDeserializer: toolEventId = Graph audit id
(idempotent upserts), eventTimestamp from activityDateTime,
result=failure -> M365_AUDIT_FAILURE, unmapped category -> M365_AUDIT_OTHER
A2.2 enrichment decision: INTEGRATED_TOOLS_EVENTS cannot supply org fields
for agentless events (machine-lookup only populates enriched data when
agentId is present), so a new PRE_ENRICHED DataEnrichmentServiceType +
PreEnrichedDataEnrichmentService passes organizationId/organizationName/
userId through from the deserialized message (populated from the
pre-enriched payload), with TenantIdProvider fallback for tenantId.
DeserializedDebeziumMessage gains organizationId/organizationName/userId
(additive; existing MessageTypes unaffected).
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
|
No actionable comments were generated in the recent review. 🎉 ℹ️ Recent review info⚙️ Run configurationConfiguration used: defaults Review profile: CHILL Plan: Pro Plus Run ID: 📒 Files selected for processing (12)
🚧 Files skipped from review as they are similar to previous changes (10)
📝 WalkthroughWalkthroughMicrosoft 365 Entra directory audit events are added across event contracts, category mappings, Debezium deserialization, pre-enrichment, and automated tests. ChangesMicrosoft 365 audit ingestion
Estimated code review effort: 3 (Moderate) | ~20 minutes Sequence Diagram(s)sequenceDiagram
participant DebeziumMessage
participant Microsoft365AuditEventDeserializer
participant EventTypeMapper
participant PreEnrichedDataEnrichmentService
participant EventDestinations
DebeziumMessage->>Microsoft365AuditEventDeserializer: deliver audit payload
Microsoft365AuditEventDeserializer->>EventTypeMapper: resolve category and result
EventTypeMapper-->>Microsoft365AuditEventDeserializer: return unified event type
Microsoft365AuditEventDeserializer->>PreEnrichedDataEnrichmentService: provide normalized message
PreEnrichedDataEnrichmentService-->>Microsoft365AuditEventDeserializer: return tenant and organization enrichment
Microsoft365AuditEventDeserializer->>EventDestinations: route Cassandra and Kafka/Pinot event
Suggested reviewers: 🚥 Pre-merge checks | ✅ 4 | ❌ 1❌ Failed checks (1 warning)
✅ Passed checks (4 passed)
✨ Finishing Touches 💡 1📝 Generate docstrings 💡
🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 3
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In
`@openframe-stream-service-core/src/main/java/com/openframe/stream/deserializer/Microsoft365AuditEventDeserializer.java`:
- Line 61: Update Microsoft365AuditEventDeserializer.java:61 to read the
directory audit identifier from id, optionally retaining auditId only as a
fallback; update Microsoft365AuditEventDeserializerTest.java:27-35 to use id and
assert the Graph identifier is populated.
- Around line 97-107: Update Microsoft365AuditEventDeserializer.buildDetails to
also preserve the provider-supplied additionalDetails field alongside
initiatedBy and targetResources, retaining its existing value when present and
non-null. Add or update the Microsoft 365 audit fixture and assertion to verify
additionalDetails is included in the persisted details payload.
- Around line 78-82: Update Microsoft365AuditEventDeserializer’s result
classification to treat both failure and timeout values as M365_AUDIT_FAILURE
before category-based mapping. Add a regression test covering a directory audit
event with result timeout and assert it produces M365_AUDIT_FAILURE.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: defaults
Review profile: CHILL
Plan: Pro Plus
Run ID: 892e1031-264a-4090-8422-0b4a4ca2a981
📒 Files selected for processing (12)
openframe-data-cassandra/src/main/java/com/openframe/data/cassandra/model/enums/UnifiedEventType.javaopenframe-data-kafka/src/main/java/com/openframe/data/model/enums/DataEnrichmentServiceType.javaopenframe-data-kafka/src/main/java/com/openframe/data/model/enums/IntegratedToolType.javaopenframe-data-kafka/src/main/java/com/openframe/data/model/enums/MessageType.javaopenframe-stream-service-core/src/main/java/com/openframe/stream/deserializer/Microsoft365AuditEventDeserializer.javaopenframe-stream-service-core/src/main/java/com/openframe/stream/mapping/EventTypeMapper.javaopenframe-stream-service-core/src/main/java/com/openframe/stream/mapping/SourceEventTypes.javaopenframe-stream-service-core/src/main/java/com/openframe/stream/model/fleet/debezium/DeserializedDebeziumMessage.javaopenframe-stream-service-core/src/main/java/com/openframe/stream/service/PreEnrichedDataEnrichmentService.javaopenframe-stream-service-core/src/test/java/com/openframe/stream/deserializer/Microsoft365AuditEventDeserializerTest.javaopenframe-stream-service-core/src/test/java/com/openframe/stream/mapping/EventTypeMapperTest.javaopenframe-stream-service-core/src/test/java/com/openframe/stream/service/PreEnrichedDataEnrichmentServiceTest.java
…itionalDetails Review follow-up (PR #1603): - Graph directoryAudits result can be success|failure|timeout — timeout now also maps to M365_AUDIT_FAILURE instead of falling through to the category mapping as an INFO event - details JSON now carries provider-supplied additionalDetails alongside initiatedBy and targetResources (payload contract extended in the poller and Graph model accordingly) Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
…ails Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
|
Note GitHub couldn't provide a complete incremental comparison for this pull request, so CodeRabbit is performing a full review instead. This review may take a little longer. |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Additive oss-lib support for Microsoft 365 Entra directory audit events (Graph
auditLogs/directoryAudits) entering the existing logs pipeline (Cassandraunified_logs+ Pinot) via the genericmessage-typepath. First stage of the MS365 audit-logs feature; the poller/listener land in the saas repos after this releases.IntegratedToolType.MICROSOFT_365("microsoft-365")— enum name becomes the PinottoolType/ Logs UI filter valueMessageType.MICROSOFT_365_AUDIT_EVENT→CASSANDRA_EVENT_LOG+KAFKA_PINOT,COMMON_TYPEUnifiedEventTypeM365_*additions (role management + audit failures areWARNING, restINFO)EventTypeMappermappings for directoryAuditscategoryvalues (UserManagement, GroupManagement, ApplicationManagement, RoleManagement, Policy, DirectoryManagement)Microsoft365AuditEventDeserializer:toolEventId= Graph audit record id (idempotent upserts across the poller's cursor overlap window),eventTimestampfromactivityDateTime,result=failure→M365_AUDIT_FAILUREregardless of category, unmapped category →M365_AUDIT_OTHER, details =initiatedBy+targetResourcesPRE_ENRICHEDenrichment type +PreEnrichedDataEnrichmentService: audit events carry no agentId, andIntegratedToolDataEnrichmentServicepopulates org fields only via the agent→machine lookup — so pre-enriched payload fields (organizationId/organizationName/userId/tenantId, stamped by the per-org poller) pass through from the deserialized message instead.DeserializedDebeziumMessagegains the three fields additively.No behavior change for existing MessageTypes; oss-tenant deploys unaffected.
Test plan
EventTypeMapperTest— 6 category mappings, unmapped→UNKNOWN, tool-scopingMicrosoft365AuditEventDeserializerTest— field mapping, tenant/org passthrough, failure override, fallback event type, timestamp fallback, null-afterPreEnrichedDataEnrichmentServiceTest— passthrough + TenantIdProvider fallbackmvn testgreen🤖 Generated with Claude Code
Summary by CodeRabbit
New Features
Bug Fixes
Tests