x-pack/filebeat/input/entityanalytics/provider/activedirectory: do no…

…t consider computers to be users (#42796) (#43016)

Active Directory classifies computers in the set of users, so
(objectClass=user) is not an adequately tight query to only return human
users. Adding the (objectCategory=person) condition resolves this.

(cherry picked from commit 058f4bd)

Co-authored-by: Dan Kortschak <dan.kortschak@elastic.co>

CHANGELOG.next.asciidoc

@@ -130,6 +130,7 @@ https://github.com/elastic/beats/compare/v8.8.1\...main[Check the HEAD diff]
 - [Journald] Fixes handling of `journalctl` restart. A known symptom was broken multiline messages when there was a restart of journalctl while aggregating the lines. {issue}41331[41331] {pull}42595[42595]
 - Fix entityanalytics activedirectory provider full sync use before initialization bug. {pull}42682[42682]
 - In the `http_endpoint` input, fix the check for a missing HMAC HTTP header. {pull}42756[42756]
+- Prevent computer details being returned for user queries by Activedirectory Entity Analytics provider. {issue}11818[11818] {pull}42796[42796]
 
 *Heartbeat*
 

x-pack/filebeat/input/entityanalytics/provider/activedirectory/internal/activedirectory/activedirectory.go

@@ -86,9 +86,9 @@ func GetDetails(url, user, pass string, base *ldap.DN, since time.Time, userAttr
 	}
 
 	// Get users in the directory...
-	userFilter := "(objectClass=user)"
+	userFilter := "(&(objectCategory=person)(objectClass=user))"
 	if sinceFmtd != "" {
-		userFilter = "(&(objectClass=user)(whenChanged>=" + sinceFmtd + "))"
+		userFilter = "(&(objectCategory=person)(objectClass=user)(whenChanged>=" + sinceFmtd + "))"
 	}
 	usrs, err := search(conn, baseDN, userFilter, userAttrs, pagingSize)
 	if err != nil {
@@ -120,7 +120,7 @@ func GetDetails(url, user, pass string, base *ldap.DN, since time.Time, userAttr
 				for i, u := range modGrps {
 					modGrps[i] = "(memberOf=" + u + ")"
 				}
-				query := "(&(objectClass=user)(|" + strings.Join(modGrps, "") + ")"
+				query := "(&(objectCategory=person)(objectClass=user)(|" + strings.Join(modGrps, "") + ")"
 				usrs, err := search(conn, baseDN, query, userAttrs, pagingSize)
 				if err != nil {
 					errs = append(errs, fmt.Errorf("failed to collect users of changed groups%w: %w", ErrUsers, err))