[receiver/windowseventlog] Add SID resolution feature by postnati · Pull Request #45878 · open-telemetry/opentelemetry-collector-contrib

postnati · 2026-02-04T19:15:41Z

Description

Adds automatic Security Identifier (SID) resolution to the Windows Event Log Receiver. This enhancement resolves Windows SIDs to human-readable user and group names using the Windows LSA API, making Windows event logs significantly more usable for security operations.

Link to tracking issue

Fixes #45875

Testing

Comprehensive unit tests added covering:

Cache operations (Get, Set, Close)
Well-known SID resolution (45+ built-in mappings)
Invalid SID handling
SID field detection logic
End-to-end enrichment scenarios
Platform-specific builds (Windows/non-Windows)

Documentation

Added comprehensive documentation to README.md, including:

Complete configuration options and defaults
Before/after examples with real SID resolution
Performance characteristics and benchmarks
Troubleshooting guide
Well-known SIDs reference
Configuration example files in testdata/

Documentation Files:

receiver/windowseventlogreceiver/README.md - Updated with SID information
receiver/windowseventlogreceiver/testdata/README.md - Complete setup guide
receiver/windowseventlogreceiver/testdata/collector-config-example.yaml - Example config

linux-foundation-easycla · 2026-02-04T19:15:53Z

The committers listed above are authorized under a signed CLA.

✅ login: postnati / name: Greg Pattison (17d5630, 195398e, 1f17834, 20ef22f, 24f71c3, 3201ebb, 38609b0, 3a58b2f, 4e8d0bd, 53639bd, 579b64d, 5ce8ea6, 6f52458, 77847bf, 7ef6083, 853e03c, 8ccbd58, 8d2aabd, 8e8cd90, 93221d1, 964ccba, a6368fe, b00e0cb, c5f1d61, e03edf9, e18cc8b, e688db2, fbb209f)

github-actions · 2026-02-04T19:15:55Z

Welcome, contributor! Thank you for your contribution to opentelemetry-collector-contrib.

Important reminders:

Please review our Contributing Guidelines.
Don't forget to sign the Contributor License Agreement (CLA) if you haven't already.

A maintainer will review your pull request soon. Thank you for helping make OpenTelemetry better!

pjanotti · 2026-02-06T20:13:54Z

@postnati, fyi - I can only start reviewing on Monday

pjanotti

Thanks @postnati it is looking good, but I can tell that it will fail some lint tests. I will allow the tests to run so you already have the list from the PR CI.

paulojmdias · 2026-02-24T19:32:25Z

/workflow-approve

postnati · 2026-03-02T13:46:05Z

Rebased onto contrib upstream/main. Fixed lint issues with Windows-only code used by cache_windows.go, and removed the dead lookupSID stub from cache_other.go.

@pjanotti Is there anything else that needs to be done to get this merged?

pjanotti · 2026-03-03T00:41:12Z

Sorry @postnati somehow I missed the changes after my round of comments, looking...

pjanotti

LGTM minus the CI failures - @postnati ping me as soon as you have a chance to look at them

Implements core SID resolution caching with: - LRU cache with configurable size and TTL - Windows LSA API integration via LsaLookupSids2 - Well-known SID static map (S-1-5-18, BUILTIN groups, etc.) - Thread-safe cache with atomic statistics - Platform-specific builds (Windows vs other) The cache provides fast local SID-to-username resolution without requiring remote LDAP/AD queries. Part of PIPE-563: SID resolution for Windows Event Log Receiver

Tests cover: - Cache creation with various configurations - Well-known SID resolution (S-1-5-18, BUILTIN groups, etc.) - Invalid SID format handling - SID field name detection - Cache statistics tracking - Cache lifecycle (close/cleanup) - SID format validation All tests pass on macOS (using well-known SIDs only). Windows-specific LSA API tests will be validated on Windows platform. Part of PIPE-563: SID resolution for Windows Event Log Receiver

Adds configuration options for SID-to-username resolution: - enabled: Enable/disable SID resolution (default: false) - cache_size: Maximum cached SIDs (default: 10000) - cache_ttl: Cache entry lifetime (default: 15m) Configuration example: ```yaml receivers: windowseventlog: channel: Security resolve_sids: enabled: true cache_size: 50000 cache_ttl: 30m ``` Part of PIPE-563: SID resolution for Windows Event Log Receiver

Adds complete SID-to-username resolution with log enrichment: **Consumer Wrapper (`sid_enrichment_windows.go`):** - Intercepts logs from Stanza adapter - Enriches security.user_id field with resolved SID data - Enriches all SID fields in event_data (SubjectUserSid, TargetUserSid, etc.) - Adds companion fields: *_Resolved, *_Domain, *_Account, *_Type - Handles both array and flat event_data formats - Graceful error handling with debug logging **Factory Integration (`receiver_windows.go`):** - Creates SID cache when resolve_sids.enabled = true - Wraps consumer with SID enrichment before Stanza adapter - Cache lifecycle managed by receiver (created at startup) - Logs cache configuration on initialization **Cross-Platform Support (`sid_enrichment_other.go`):** - Stub for macOS/Linux (compiles but no-op) - Allows development on non-Windows platforms Example enriched output: ```json "event_data": { "data": [ {"SubjectUserSid": "S-1-5-18"}, {"SubjectUserSid_Resolved": "NT AUTHORITY\\SYSTEM"}, {"SubjectUserSid_Domain": "NT AUTHORITY"}, {"SubjectUserSid_Account": "SYSTEM"}, {"SubjectUserSid_Type": "WellKnownGroup"} ] } ``` Part of PIPE-563: SID resolution for Windows Event Log Receiver

Fixes compilation error where raw values were passed to Logger.Info instead of using zap.Int() and zap.Duration() field constructors. Part of PIPE-563: SID resolution for Windows Event Log Receiver

…ture

…ry documentation - Add testdata directory with test configurations from upstream OTel contrib - Remove temporary SID resolution documentation files

…ntribution Update copyright headers from observIQ to OpenTelemetry Authors with SPDX license identifiers, and migrate import paths from bindplane-otel-collector to opentelemetry-collector-contrib. Also update documentation and configuration examples to reflect the new build process and binary names. Changes: - Replace observIQ copyright with OpenTelemetry Authors copyright and SPDX-License-Identifier - Update import paths from github.com/observiq/bindplane-otel-collector to github.com/open-telemetry/opentelemetry-collector-contrib - Fix linter issues: use errors.New instead of fmt.Errorf, fix unused receiver warning, add nolint directive for non-Windows stub - Update testdata documentation with correct build commands and binary names - Update collector configuration examples with new binary names

Add changelog entry for the Windows Event Log Receiver SID resolution enhancement per OpenTelemetry contribution guidelines.

Links changelog entry to upstream issue for SID resolution feature.

…arshalling

Assisted-by: Claude Opus 4.6

…ent concurrency safety Assisted-by: Claude Opus 4.6

…go.mod to add back in golang-lru

otelbot · 2026-03-06T22:28:06Z

Thank you for your contribution @postnati! 🎉 We would like to hear from you about your experience contributing to OpenTelemetry by taking a few minutes to fill out this survey. If you are getting started contributing, you can also join the CNCF Slack channel #opentelemetry-new-contributors to ask for guidance and get help.

…#45878) #### Description Adds automatic Security Identifier (SID) resolution to the Windows Event Log Receiver. This enhancement resolves Windows SIDs to human-readable user and group names using the Windows LSA API, making Windows event logs significantly more usable for security operations. #### Link to tracking issue Fixes open-telemetry#45875 #### Testing Comprehensive unit tests added covering: - Cache operations (Get, Set, Close) - Well-known SID resolution (45+ built-in mappings) - Invalid SID handling - SID field detection logic - End-to-end enrichment scenarios - Platform-specific builds (Windows/non-Windows) #### Documentation Added comprehensive documentation to README.md, including: - Complete configuration options and defaults - Before/after examples with real SID resolution - Performance characteristics and benchmarks - Troubleshooting guide - Well-known SIDs reference - Configuration example files in testdata/ **Documentation Files:** - `receiver/windowseventlogreceiver/README.md` - Updated with SID information - `receiver/windowseventlogreceiver/testdata/README.md` - Complete setup guide - `receiver/windowseventlogreceiver/testdata/collector-config-example.yaml` - Example config

…#45878) Adds automatic Security Identifier (SID) resolution to the Windows Event Log Receiver. This enhancement resolves Windows SIDs to human-readable user and group names using the Windows LSA API, making Windows event logs significantly more usable for security operations. Fixes open-telemetry#45875 Comprehensive unit tests added covering: - Cache operations (Get, Set, Close) - Well-known SID resolution (45+ built-in mappings) - Invalid SID handling - SID field detection logic - End-to-end enrichment scenarios - Platform-specific builds (Windows/non-Windows) Added comprehensive documentation to README.md, including: - Complete configuration options and defaults - Before/after examples with real SID resolution - Performance characteristics and benchmarks - Troubleshooting guide - Well-known SIDs reference - Configuration example files in testdata/ **Documentation Files:** - `receiver/windowseventlogreceiver/README.md` - Updated with SID information - `receiver/windowseventlogreceiver/testdata/README.md` - Complete setup guide - `receiver/windowseventlogreceiver/testdata/collector-config-example.yaml` - Example config

…#45878) #### Description Adds automatic Security Identifier (SID) resolution to the Windows Event Log Receiver. This enhancement resolves Windows SIDs to human-readable user and group names using the Windows LSA API, making Windows event logs significantly more usable for security operations. #### Link to tracking issue Fixes open-telemetry#45875 #### Testing Comprehensive unit tests added covering: - Cache operations (Get, Set, Close) - Well-known SID resolution (45+ built-in mappings) - Invalid SID handling - SID field detection logic - End-to-end enrichment scenarios - Platform-specific builds (Windows/non-Windows) #### Documentation Added comprehensive documentation to README.md, including: - Complete configuration options and defaults - Before/after examples with real SID resolution - Performance characteristics and benchmarks - Troubleshooting guide - Well-known SIDs reference - Configuration example files in testdata/ **Documentation Files:** - `receiver/windowseventlogreceiver/README.md` - Updated with SID information - `receiver/windowseventlogreceiver/testdata/README.md` - Complete setup guide - `receiver/windowseventlogreceiver/testdata/collector-config-example.yaml` - Example config

postnati requested review from a team and pjanotti as code owners February 4, 2026 19:15

github-actions bot assigned atoulme Feb 4, 2026

github-actions bot added the first-time contributor PRs made by new contributors label Feb 4, 2026

github-actions bot added the receiver/windowseventlog label Feb 4, 2026

github-actions bot requested a review from armstrmi February 4, 2026 19:15

pjanotti reviewed Feb 10, 2026

View reviewed changes

pjanotti mentioned this pull request Feb 10, 2026

[proposal, windowseventlog] Create extended_format config for windowseventlogreceiver xml formatting. #45925 #45926

Closed

postnati force-pushed the gpattison/PIPE-563-resolve-sids branch from 3c8a4b3 to 4976faf Compare February 18, 2026 14:08

postnati force-pushed the gpattison/PIPE-563-resolve-sids branch from 4976faf to 4c6f3d7 Compare March 2, 2026 13:27

pjanotti reviewed Mar 3, 2026

View reviewed changes

postnati added 13 commits March 6, 2026 13:05

fix: Use proper zap field constructors for logging

964ccba

Fixes compilation error where raw values were passed to Logger.Info instead of using zap.Int() and zap.Duration() field constructors. Part of PIPE-563: SID resolution for Windows Event Log Receiver

chore: Format test file (import ordering and spacing)

fbb209f

test: Add comprehensive unit tests for SID enrichment consumer

4e8d0bd

docs: Add comprehensive SID resolution documentation to README

8e8cd90

chore: Apply goimports formatting (alignment and unused imports)

8d2aabd

fix: Address linter warnings (unused parameters and package comment)

77847bf

docs: Add comprehensive implementation summary for SID resolution fea…

1f17834

…ture

docs: Add comprehensive JSON output demonstration for SID resolution

93221d1

chore: Add testdata for Windows Event Log Receiver and remove tempora…

7ef6083

…ry documentation - Add testdata directory with test configurations from upstream OTel contrib - Remove temporary SID resolution documentation files

postnati added 13 commits March 6, 2026 13:05

chore: Add changelog entry for SID resolution feature

20ef22f

Add changelog entry for the Windows Event Log Receiver SID resolution enhancement per OpenTelemetry contribution guidelines.

chore: Update changelog with GitHub issue open-telemetry#45875

24f71c3

Links changelog entry to upstream issue for SID resolution feature.

fix: change CacheSize to uint to reject negative values at config unm…

e03edf9

…arshalling

fix: validate CacheTTL rejects negative durations as config error

17d5630

Assisted-by: Claude Opus 4.6

fix: use errors.New for static error strings to satisfy linter

53639bd

refactor: extract common SID resolution logic to reduce duplication

b00e0cb

refactor: move Windows-only cache types to cache_windows.go and docum…

38609b0

…ent concurrency safety Assisted-by: Claude Opus 4.6

docs: fix README.md wording and formatting per reviewer feedback

e688db2

docs: fix testdata/README.md formatting per reviewer feedback

195398e

Fixed linting issues

6f52458

Fixed lint errors for windows-only code

e18cc8b

Fixed Test failure on Windows

853e03c

postnati force-pushed the gpattison/PIPE-563-resolve-sids branch from 1d59418 to 853e03c Compare March 6, 2026 18:06

postnati added 2 commits March 6, 2026 14:53

Add import comments and fix unsafe pointer type in SID cache. Update …

c5f1d61

…go.mod to add back in golang-lru

Updated schema

3a58b2f

pjanotti approved these changes Mar 6, 2026

View reviewed changes

pjanotti added the ready to merge Code review completed; ready to merge by maintainers label Mar 6, 2026

atoulme merged commit 06d436c into open-telemetry:main Mar 6, 2026
207 checks passed

Conversation

postnati commented Feb 4, 2026

Description

Link to tracking issue

Testing

Documentation

Uh oh!

linux-foundation-easycla bot commented Feb 4, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

github-actions bot commented Feb 4, 2026

Uh oh!

pjanotti commented Feb 6, 2026

Uh oh!

pjanotti left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

paulojmdias commented Feb 24, 2026

Uh oh!

postnati commented Mar 2, 2026

Uh oh!

pjanotti commented Mar 3, 2026

Uh oh!

pjanotti left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

otelbot bot commented Mar 6, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

4 participants

linux-foundation-easycla bot commented Feb 4, 2026 •

edited

Loading