Add Advanced Analytics (UEBA) category to entity analytics integrations

[uri-weisman]

Proposed commit message

Add the Advanced Analytics (UEBA) subcategory to entity analytics integrations

Add the advanced_analytics_ueba subcategory to entityanalytics_okta,
entityanalytics_entra_id, and entityanalytics_ad so they appear under
Advanced Analytics (UEBA) in Fleet alongside other UEBA packages.

Summary

Adds the advanced_analytics_ueba subcategory to all entity analytics integrations so they appear under Advanced Analytics (UEBA) in Fleet, consistent with other UEBA packages (e.g. ProblemChild, LMD, DGA).

Packages updated

• entityanalytics_okta (2.5.1 → 2.5.2)
• entityanalytics_entra_id (1.8.1 → 1.8.2)
• entityanalytics_ad (0.17.0 → 0.17.1)

Changes

• Added advanced_analytics_ueba to categories in each package manifest
• Bumped package versions and added changelog entries

How to test this PR locally

cd packages/entityanalytics_okta && elastic-package lint
cd packages/entityanalytics_entra_id && elastic-package lint
cd packages/entityanalytics_ad && elastic-package lint

Checklist

• I have added an entry to my package's changelog.yml file.

[cla-checker-service]

💚 CLA has been signed

[infra-vault-gh-plugin-prod]

💔 Build Failed

• Buildkite Build
• Commit: 9e8bf55

Failed CI Steps

• :pipeline:⬆️ Upload Pipeline: .buildkite/pipeline.yml

History

[uri-weisman]

@copilot resolve the merge conflicts in this pull request

[github-actions]

TL;DR

The Buildkite failure is a merge-conflict failure in the repository post-checkout hook, not a package lint or test failure. The PR branch is based on an older state of the three package manifests/changelogs, while main has changed those same files; the hook cannot auto-merge the PR and exits before the pipeline is uploaded.

Remediation

• Rebase the PR branch onto the current main (or merge main into it) and resolve conflicts in all six files under packages/entityanalytics_{ad,entra_id,okta}/. Preserve the newer main package versions and changelog entries, then add advanced_analytics_ueba and use the next patch versions with matching changelog entries; the current main versions are AD 0.20.3, Entra ID 1.10.2, and Okta 3.3.0, whereas this PR still targets 0.17.1, 1.8.2, and 2.5.2.
• Run elastic-package lint in each of the three packages, then push the rebased/conflict-free branch to rerun Buildkite.

Investigation details

Root Cause

The .buildkite/hooks/post-checkout merge step failed while preparing pr_merge_20103. Git reported content conflicts in packages/entityanalytics_ad/changelog.yml, packages/entityanalytics_ad/manifest.yml, packages/entityanalytics_entra_id/changelog.yml, packages/entityanalytics_entra_id/manifest.yml, packages/entityanalytics_okta/changelog.yml, and packages/entityanalytics_okta/manifest.yml. The PR diff confirms it changes exactly those six files and is based on older package versions, so the merge cannot be completed automatically without resolving the overlapping edits.

Evidence

• Build: https://buildkite.com/elastic/integrations/builds/45933
• Job/step: :pipeline::arrow_up: Upload Pipeline: .buildkite/pipeline.yml
• Key log excerpt: CONFLICT (content) for each manifest/changelog pair, followed by Automatic merge failed; fix conflicts and then commit the result. and repository post-checkout shell hook exited with status 1.
• Current main package versions: packages/entityanalytics_ad/manifest.yml:4 (0.20.3), packages/entityanalytics_entra_id/manifest.yml:4 (1.10.2), and packages/entityanalytics_okta/manifest.yml:4 (3.3.0).

Verification

No package tests or lints ran: the repository post-checkout hook failed before the pipeline could be uploaded.

---

What is this? | From workflow: PR Buildkite Detective

Give us feedback! React with 🚀 if perfect, 👍 if helpful, 👎 if not.

[github-actions]

✅ Elastic Docs Style Checker (Vale)

No issues found on modified lines!

---

The Vale linter checks documentation changes against the Elastic Docs style guide. To use Vale locally or report issues, refer to Elastic style guide for Vale.

[infra-vault-gh-plugin-prod]

Pinging @elastic/security-service-integrations (Team:Security-Service Integrations)

[vera-review-bot]

No issues across the latest commits de59afb.

A new commit triggers another review — at most once every 15 minutes. I skip the PR while it's approved or has merge conflicts.

🤖 AI-Generated Review | Vera Review Bot | 📚 Knowledge base: integration-skills

⚠️ Automated review — verify suggestions before applying.