Add Domain to types.Host

[andrewkroh]

Add a Domain Field to the types.Host struct. For Windows this should be populated with the host's Active Directory (AD) or Entra ID domain name. This value should satisfy the definition of the host.domain field in ECS.

Windows registry data sources

• For Active Directory - HKLM:SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Group Policy\\State\\Machine and read Distinguished-Name
  • This is the distinguished name (DN) of the Active Directory that the local computer is associated with for the purposes of Group Policy. It typically follows a format like CN=ComputerName,OU=Computers,DC=domain,DC=com. I think we would join together the DC components to form the domain name.
• For Entra ID - HKLM:SYSTEM\\CurrentControlSet\\Control\\CloudDomainJoin\\JoinInfo\\
  • Iff JoinInfo contains one entry then get the UserEmail value from within that entry and then parse the domain from the email address. If JoinInfo contains more than one entry then the computer is joined to more than one domain so do nothing.

References

• ECS host.domain
• https://nerdymishka.com/articles/azure-ad-domain-join-registry-keys/

[jrmolin]

Is that Iff an If-and-only-if or just a mistype? From context, it looks like if-and-only-if. I love seeing the maths in here!

[andrewkroh]

That's the problem with iff outside of math/logic contexts, you never know if it is intentional or a typo 😆 . I did lazily mean if and only if. I probably should have written "if JoinInfo contains exactly one subkey then read the UserEmail value from that subkey...".