x-pack/filebeat/input/entityanalytics/provider/jamf: wire Jamf into minimal-state registry

Register the entcollect Jamf provider under the "jamf" name so that the
entity-analytics input can use it in minimal-state mode (use_minimal_state:
true). The registration mirrors the pattern established by the beats
shim merged in elastic#49871.

A local UCF-tagged struct (localConf) is defined inside minimalProvider
to bridge the ucfg config dialect (config:"" tags) to ecjamf.Config,
which uses json:"" tags for cross-runtime portability. Fields are mapped
explicitly so that a mismatch is a compile error rather than a silent
zero. TestMinimalConfigRoundTrip guards against future drift: if
ecjamf.Config gains a new field the field-count assertion fails, forcing
localConf and the test to be updated together.

Assisted-By: Cursor (claude-opus-4-6)

Author: efd6

NOTICE.txt

@@ -11452,11 +11452,11 @@ Contents of probable licence file $GOMODCACHE/github.com/elastic/elastic-agent-s
 
 --------------------------------------------------------------------------------
 Dependency : github.com/elastic/entcollect
-Version: v0.0.0-20260408214411-765a9bedd20c
+Version: v0.0.0-20260501012805-5fd94422b104
 Licence type (autodetected): Elastic
 --------------------------------------------------------------------------------
 
-Contents of probable licence file $GOMODCACHE/github.com/elastic/entcollect@v0.0.0-20260408214411-765a9bedd20c/LICENSE.txt:
+Contents of probable licence file $GOMODCACHE/github.com/elastic/entcollect@v0.0.0-20260501012805-5fd94422b104/LICENSE.txt:
 
 Elastic License 2.0
 

changelog/fragments/1777610237-jamf-minimal-state-provider.yaml

@@ -0,0 +1,3 @@
+kind: feature
+summary: Add Jamf provider support for entity analytics minimal-state mode.
+component: filebeat

go.mod

@@ -236,7 +236,7 @@ require (
 	github.com/apache/arrow-go/v18 v18.4.1
 	github.com/cilium/ebpf v0.21.0
 	github.com/coder/websocket v1.8.14
-	github.com/elastic/entcollect v0.0.0-20260408214411-765a9bedd20c
+	github.com/elastic/entcollect v0.0.0-20260501012805-5fd94422b104
 	github.com/elastic/gokrb5/v8 v8.0.0-20251105095404-23cc45e6a102
 	github.com/mattn/go-sqlite3 v1.14.32
 	github.com/parsiya/golnk v0.0.0-20251207220015-443df11fe4fb

go.sum

@@ -389,8 +389,8 @@ github.com/elastic/elastic-agent-system-metrics v0.14.3 h1:v867kcgCVguOX3AYIHEVn
 github.com/elastic/elastic-agent-system-metrics v0.14.3/go.mod h1:JNfnZrC0viAjlJRUzQKKuMpDlXgjXBn4WdWEXQF7jcA=
 github.com/elastic/elastic-transport-go/v8 v8.8.0 h1:7k1Ua+qluFr6p1jfJjGDl97ssJS/P7cHNInzfxgBQAo=
 github.com/elastic/elastic-transport-go/v8 v8.8.0/go.mod h1:YLHer5cj0csTzNFXoNQ8qhtGY1GTvSqPnKWKaqQE3Hk=
-github.com/elastic/entcollect v0.0.0-20260408214411-765a9bedd20c h1:Mad7EnSJiXwg0HokotucGjGRLyrdHSqFEkVWw75xU2M=
-github.com/elastic/entcollect v0.0.0-20260408214411-765a9bedd20c/go.mod h1:jEKK/XEA4Xnu0ssVhLBlExQHPwb1A0b1E2MsPLlpxmY=
+github.com/elastic/entcollect v0.0.0-20260501012805-5fd94422b104 h1:en8CqvVRWRToaE++kq+pjJGD7WZJtY8hGRmuc3O8zso=
+github.com/elastic/entcollect v0.0.0-20260501012805-5fd94422b104/go.mod h1:jEKK/XEA4Xnu0ssVhLBlExQHPwb1A0b1E2MsPLlpxmY=
 github.com/elastic/fsevents v0.0.0-20181029231046-e1d381a4d270 h1:cWPqxlPtir4RoQVCpGSRXmLqjEHpJKbR60rxh1nQZY4=
 github.com/elastic/fsevents v0.0.0-20181029231046-e1d381a4d270/go.mod h1:Msl1pdboCbArMF/nSCDUXgQuWTeoMmE/z8607X+k7ng=
 github.com/elastic/fsnotify v1.6.1-0.20240920222514-49f82bdbc9e3 h1:UyNbxdkQiSfyipwsOCWAlO+ju3xXC61Z4prx/HBTtFk=

x-pack/filebeat/input/entityanalytics/provider/jamf/minimal.go

@@ -0,0 +1,66 @@
+// Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+// or more contributor license agreements. Licensed under the Elastic License;
+// you may not use this file except in compliance with the Elastic License.
+
+package jamf
+
+import (
+	"time"
+
+	"github.com/elastic/elastic-agent-libs/config"
+	"github.com/elastic/elastic-agent-libs/logp"
+
+	"github.com/elastic/entcollect"
+	ecjamf "github.com/elastic/entcollect/provider/jamf"
+
+	"github.com/elastic/beats/v7/x-pack/filebeat/input/entityanalytics/provider"
+)
+
+func init() {
+	err := provider.RegisterMinimalStateProvider(Name, minimalProvider)
+	if err != nil {
+		panic(err)
+	}
+}
+
+func minimalProvider(cfg *config.C, _ *logp.Logger) (entcollect.Provider, time.Duration, time.Duration, error) {
+	// localConf mirrors ecjamf.Config with config:"" tags for UCF Unpack.
+	// If ecjamf.Config gains a new field, add it here and in the mapping
+	// below; TestMinimalConfigRoundTrip (minimal_test.go) will catch any drift.
+	type localConf struct {
+		TenantID       string        `config:"jamf_tenant"        validate:"required"`
+		Username       string        `config:"jamf_username"      validate:"required"`
+		Password       string        `config:"jamf_password"      validate:"required"`
+		PageSize       int           `config:"page_size"`
+		IDSetShards    int           `config:"idset_shards"`
+		TokenGrace     time.Duration `config:"token_grace_period"`
+		SyncInterval   time.Duration `config:"sync_interval"`
+		UpdateInterval time.Duration `config:"update_interval"`
+	}
+
+	d := ecjamf.DefaultConfig()
+	lc := localConf{
+		PageSize:       d.PageSize,
+		IDSetShards:    d.IDSetShards,
+		TokenGrace:     d.TokenGrace,
+		SyncInterval:   d.SyncInterval,
+		UpdateInterval: d.UpdateInterval,
+	}
+	if err := cfg.Unpack(&lc); err != nil {
+		return nil, 0, 0, err
+	}
+	ec := ecjamf.Config{
+		TenantID:       lc.TenantID,
+		Username:       lc.Username,
+		Password:       lc.Password,
+		PageSize:       lc.PageSize,
+		IDSetShards:    lc.IDSetShards,
+		TokenGrace:     lc.TokenGrace,
+		SyncInterval:   lc.SyncInterval,
+		UpdateInterval: lc.UpdateInterval,
+	}
+	if err := ec.Validate(); err != nil {
+		return nil, 0, 0, err
+	}
+	return ecjamf.New(ec), ec.SyncInterval, ec.UpdateInterval, nil
+}

x-pack/filebeat/input/entityanalytics/provider/jamf/minimal_test.go

@@ -0,0 +1,56 @@
+// Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+// or more contributor license agreements. Licensed under the Elastic License;
+// you may not use this file except in compliance with the Elastic License.
+
+package jamf
+
+import (
+	"reflect"
+	"testing"
+	"time"
+
+	"github.com/elastic/elastic-agent-libs/config"
+	ecjamf "github.com/elastic/entcollect/provider/jamf"
+)
+
+// TestMinimalConfigRoundTrip verifies that every exported field of
+// ecjamf.Config is represented in the localConf mirror inside
+// minimalProvider. It does this in two ways:
+//
+//  1. Field-count assertion — if ecjamf.Config gains a field, the count
+//     check fails, forcing the developer to update localConf and this test.
+//  2. Functional round-trip — all fields are set to non-default sentinel
+//     values; the returned sync intervals must match, confirming that at
+//     least the duration fields are wired through end-to-end.
+func TestMinimalConfigRoundTrip(t *testing.T) {
+	const wantFields = 8
+	if got := reflect.TypeOf(ecjamf.Config{}).NumField(); got != wantFields {
+		t.Fatalf("ecjamf.Config has %d exported fields, want %d; "+
+			"update localConf inside minimalProvider and this test", got, wantFields)
+	}
+
+	wantSync := 48 * time.Hour
+	wantUpdate := 30 * time.Minute
+
+	cfg := config.MustNewConfigFrom(map[string]any{
+		"jamf_tenant":        "tenant.jamfcloud.com",
+		"jamf_username":      "user",
+		"jamf_password":      "pass",
+		"page_size":          50,
+		"idset_shards":       32,
+		"token_grace_period": "2m",
+		"sync_interval":      wantSync.String(),
+		"update_interval":    wantUpdate.String(),
+	})
+
+	_, gotSync, gotUpdate, err := minimalProvider(cfg, nil)
+	if err != nil {
+		t.Fatalf("minimalProvider returned unexpected error: %v", err)
+	}
+	if gotSync != wantSync {
+		t.Errorf("sync_interval: got %v, want %v", gotSync, wantSync)
+	}
+	if gotUpdate != wantUpdate {
+		t.Errorf("update_interval: got %v, want %v", gotUpdate, wantUpdate)
+	}
+}