x-pack/filebeat/input/entityanalytics{,/provider/activedirectory}: re…

…gister and fix published entity (#38645)

This adds a missing registration import and publishes the complete
entry, not just the user component.

CHANGELOG.next.asciidoc

@@ -93,6 +93,7 @@ https://github.com/elastic/beats/compare/v8.8.1\...main[Check the HEAD diff]
 - Fix PEM key validation for CEL and HTTPJSON inputs. {pull}38405[38405]
 - Fix filebeat gcs input panic {pull}38407[38407]
 - Rename `activity_guid` to `activity_id` in ETW input events to suit other Windows inputs. {pull}38530[38530]
+- Add missing provider registration and fix published entity for Active Directory entityanalytics provider. {pull}38645[38645]
 
 *Heartbeat*
 

x-pack/filebeat/input/entityanalytics/input.go

@@ -15,6 +15,7 @@ import (
 	"github.com/elastic/go-concert/unison"
 
 	// For provider registration.
+	_ "github.com/elastic/beats/v7/x-pack/filebeat/input/entityanalytics/provider/activedirectory"
 	_ "github.com/elastic/beats/v7/x-pack/filebeat/input/entityanalytics/provider/azuread"
 	_ "github.com/elastic/beats/v7/x-pack/filebeat/input/entityanalytics/provider/okta"
 )

x-pack/filebeat/input/entityanalytics/provider/activedirectory/activedirectory.go

@@ -383,7 +383,7 @@ func (p *adInput) publishMarker(ts, eventTime time.Time, inputID string, start b
 func (p *adInput) publishUser(u *User, state *stateStore, inputID string, client beat.Client, tracker *kvstore.TxTracker) {
 	userDoc := mapstr.M{}
 
-	_, _ = userDoc.Put("activedirectory", u.User)
+	_, _ = userDoc.Put("activedirectory", u.Entry)
 	_, _ = userDoc.Put("labels.identity_source", inputID)
 	_, _ = userDoc.Put("user.id", u.ID)