elastic · muskan-agarwal26 · Jul 12, 2026 · Jul 12, 2026 · Jul 12, 2026
diff --git a/.github/CODEOWNERS b/.github/CODEOWNERS
@@ -431,6 +431,7 @@
 /packages/panw_metrics @elastic/obs-infraobs-integrations
 /packages/pfsense @elastic/integration-experience
 /packages/php_fpm @elastic/obs-infraobs-integrations
+/packages/ping_directory @elastic/security-service-integrations
 /packages/ping_federate @elastic/security-service-integrations @elastic/sit-crest-contractors
 /packages/ping_one @elastic/security-service-integrations @elastic/sit-crest-contractors
 /packages/platform_observability @elastic/stack-monitoring

@@ -0,0 +1,93 @@
+Elastic License 2.0
+
+URL: https://www.elastic.co/licensing/elastic-license
+
+## Acceptance
+
+By using the software, you agree to all of the terms and conditions below.
+
+## Copyright License
+
+The licensor grants you a non-exclusive, royalty-free, worldwide,
+non-sublicensable, non-transferable license to use, copy, distribute, make
+available, and prepare derivative works of the software, in each case subject to
+the limitations and conditions below.
+
+## Limitations
+
+You may not provide the software to third parties as a hosted or managed
+service, where the service provides users with access to any substantial set of
+the features or functionality of the software.
+
+You may not move, change, disable, or circumvent the license key functionality
+in the software, and you may not remove or obscure any functionality in the
+software that is protected by the license key.
+
+You may not alter, remove, or obscure any licensing, copyright, or other notices
+of the licensor in the software. Any use of the licensor’s trademarks is subject
+to applicable law.
+
+## Patents
+
+The licensor grants you a license, under any patent claims the licensor can
+license, or becomes able to license, to make, have made, use, sell, offer for
+sale, import and have imported the software, in each case subject to the
+limitations and conditions in this license. This license does not cover any
+patent claims that you cause to be infringed by modifications or additions to
+the software. If you or your company make any written claim that the software
+infringes or contributes to infringement of any patent, your patent license for
+the software granted under these terms ends immediately. If your company makes
+such a claim, your patent license ends immediately for work on behalf of your
+company.
+
+## Notices
+
+You must ensure that anyone who gets a copy of any part of the software from you
+also gets a copy of these terms.
+
+If you modify the software, you must include in any modified copies of the
+software prominent notices stating that you have modified the software.
+
+## No Other Rights
+
+These terms do not imply any licenses other than those expressly granted in
+these terms.
+
+## Termination
+
+If you use the software in violation of these terms, such use is not licensed,
+and your licenses will automatically terminate. If the licensor provides you
+with a notice of your violation, and you cease all violation of this license no
+later than 30 days after you receive that notice, your licenses will be
+reinstated retroactively. However, if you violate these terms after such
+reinstatement, any additional violation of these terms will cause your licenses
+to terminate automatically and permanently.
+
+## No Liability
+
+*As far as the law allows, the software comes as is, without any warranty or
+condition, and the licensor will not be liable to you for any damages arising
+out of these terms or the use or nature of the software, under any kind of
+legal claim.*
+
+## Definitions
+
+The **licensor** is the entity offering these terms, and the **software** is the
+software the licensor makes available under these terms, including any portion
+of it.
+
+**you** refers to the individual or entity agreeing to these terms.
+
+**your company** is any legal entity, sole proprietorship, or other kind of
+organization that you work for, plus all organizations that have control over,
+are under the control of, or are under common control with that
+organization. **control** means ownership of substantially all the assets of an
+entity, or the power to direct its management and policies by vote, contract, or
+otherwise. Control can be direct or indirect.
+
+**your licenses** are all the licenses granted to you for the software under
+these terms.
+
+**use** means anything you do with the software requiring one of your licenses.
+
+**trademark** means trademarks, service marks, and similar rights.
@@ -0,0 +1,3 @@
+dependencies:
+  ecs:
+    reference: git@v9.4.0
@@ -0,0 +1,104 @@
+# PingDirectory Integration for Elastic
+
+## Overview
+
+[PingDirectory](https://www.pingidentity.com/en/product/pingdirectory.html) is an **enterprise-grade LDAP directory server** and identity data store. It provides high-performance, scalable directory services for managing user identities, credentials, and access control across hybrid environments — combining authentication, authorization, and directory data management into a unified platform for **critical identity infrastructure**.
+
+This integration collects data from PingDirectory log files using the Elastic Agent filestream input, or over the network using the Elastic Agent UDP input. It provides visibility into LDAP connection activity, requests, results, and security negotiation events across your PingDirectory environment.
+
+### Compatibility
+
+The PingDirectory integration is compatible with **PingDirectory version 11.0.0.2 and above**.
+
+### How it works
+
+The integration uses the Elastic Agent filestream input to collect log files generated by PingDirectory on a configurable path, or the UDP input to receive logs forwarded by a PingDirectory Syslog Text Access Log Publisher. Each collection cycle:
+
+1. Reads log entries from the configured PingDirectory LDAP Access log file (`access.log`), or receives them over UDP when syslog forwarding is used.
+2. Parses each log line using a grok pattern to extract fields such as timestamp, connection ID, operation type, instance name, client and server IP/port, requester DN, and result code.
+3. Extracts operation-specific details including request type, search filters, response time, and result codes from the access log record.
+4. Emits each log entry as an individual event for ingestion and enrichment via the built-in ingest pipeline.
+
+## What data does this integration collect?
+
+The PingDirectory integration collects the following types of data:
+
+| Data stream | Description |
+|---|---|
+| `ldap_access` | LDAP access logs generated by PingDirectory, including connection and disconnection events, LDAP requests and results, security negotiation details, client and server addresses, requester identities, and response times for monitoring LDAP client activity across your directory environment.
+
+### Supported use cases
+
+* **LDAP connection monitoring**: Track connect, disconnect, and security negotiation events to gain visibility into client connection activity and TLS/cipher usage across your directory environment.
+
+* **Operational troubleshooting and access analysis**: Analyze who performed which LDAP operations, from which client IP, with what result code, and at what response time to investigate failed binds, slow searches, and unauthorized access attempts.
+
+## What do I need to use this integration?
+
+### From PingDirectory
+
+* **PingDirectory deployment**: An active PingDirectory server configured to generate LDAP Access logs.
+* **Access logging enabled**: The File-Based Access Logger must be enabled to record LDAP operations, or a Syslog Text Access Log Publisher must be configured to forward access logs over UDP. To configure the publisher: in the PingDirectory Administrative Console, go to **Configuration → Log Publishers → New Log Publisher → Syslog Text Access Log Publisher**, create a **Syslog External Server** with the Elastic Agent host and UDP port (must match the integration's **Listen Port**, default `9602`), then enable and save the publisher.
+* **Log access**: Elastic Agent must have access to the Access log files on the PingDirectory host, or network access to receive the forwarded syslog UDP traffic.
+* **Elastic Agent**: Version 8.18+ or 9.0+ with Fleet enrollment.
+
+## How do I deploy this integration?
+
+### Agent-based deployment
+
+Elastic Agent must be installed. For more details, check the Elastic Agent [installation instructions](docs-content://reference/fleet/install-elastic-agents.md). You can install only one Elastic Agent per host.
+
+Elastic Agent is required to stream data from the syslog or log file receiver and ship the data to Elastic, where the events will then be processed via the integration's ingest pipelines.
+
+### Configure
+
+1. In Kibana, navigate to **Fleet → Integrations** and search for **PingDirectory**.
+2. Click **Add PingDirectory**.
+3. Configure the integration settings:
+
+   * To collect from a local log file, enable the filestream input and specify the **Paths** to the PingDirectory LDAP Access log file(s), for example:
+   /opt/pingdirectory/logs/access*
+   * To receive logs forwarded over the network, enable the UDP input and set the **Listen Address** and **Listen Port** to match the Syslog External Server configured on PingDirectory.
+   * Configure any optional collection settings as required.
+4. Select **Save and continue** to save the integration.
+5. Add the integration to an existing Agent policy or create a new one.
+6. Verify that LDAP Access events are being ingested into Elasticsearch.
+
+### Validation
+
+#### Dashboard populated
+
+1. In the top search bar in Kibana, search for **Dashboards**.
+2. In the search bar, type **PingDirectory**.
+3. Open the **[Logs PingDirectory] LDAP Access** dashboard.
+4. Verify that the visualizations are populated with LDAP access data, including connection events, requester identities, result codes, and client IP addresses.
+
+## Scaling
+
+For more information on architectures that can be used for scaling this integration, check the [Ingest Architectures](https://www.elastic.co/docs/manage-data/ingest/ingest-reference-architectures) documentation.
+
+## Troubleshooting
+
+* **No data collected**: Verify that the PingDirectory File-Based Access Logger is enabled and generating log entries, or that the Syslog Text Access Log Publisher is enabled and pointed at the correct Elastic Agent host and port. Confirm that the configured log file path or UDP listener matches the location of the Access logs.
+
+For help with Elastic ingest tools, check [Common problems](https://www.elastic.co/docs/troubleshoot/ingest/fleet/common-problems).
+
+## Reference
+
+### LDAP Access
+
+The `ldap_access` data stream provides LDAP access logs from ping_directory.
+
+#### LDAP Access fields
+
+{{fields "ldap_access"}}
+
+### Example event
+
+#### LDAP Access
+
+{{event "ldap_access"}}
+
+### Inputs used
+
+{{ inputDocs }}
@@ -0,0 +1,13 @@
+version: '2.3'
+services:
+  ping_directory-udp-ldap_access:
+    image: docker.elastic.co/observability/stream:v0.22.0
+    volumes:
+      - ./sample_logs:/sample_logs:ro
+    command: log --start-signal=SIGHUP --delay=5s --addr elastic-agent:9599 -p=udp /sample_logs/test-ldap_access.log
+  ping_directory-logfile-ldap_access:
+    image: alpine
+    volumes:
+      - ./sample_logs:/sample_logs:ro
+      - ${SERVICE_LOGS_DIR}:/var/log
+    command: /bin/sh -c "cp /sample_logs/* /var/log/"
@@ -0,0 +1,3 @@
+[25/May/2026:18:30:48.688 +0530] ADD RESULT instanceName="pingdirectory-elastic-test" threadID=9 conn=4 op=1 msgID=2 requesterIP="127.0.0.1" requesterDN="cn=Directory Manager,cn=Root DNs,cn=config" dn="ou=People,dc=example,dc=com" resultCode=0 resultCodeName="Success" qtime=0 etime=24.567 usedPrivileges="bypass-acl"
+[25/May/2026:18:32:55.559 +0530] ADD RESULT instanceName="pingdirectory-elastic-test" threadID=10 conn=5 op=1 msgID=2 requesterIP="127.0.0.1" requesterDN="cn=Directory Manager,cn=Root DNs,cn=config" dn="uid=john.doe,ou=People,dc=example,dc=com" resultCode=65 resultCodeName="Object Class Violation" message="Entry 'uid=john.doe,ou=People,dc=example,dc=com' violates the Directory Server schema configuration because it includes attribute 'department' which is not allowed by any of the object classes defined in that entry" qtime=1 etime=3.178 usedPrivileges="bypass-acl"
+[25/May/2026:19:29:51.686 +0530] DISCONNECT requesterIP="172.20.240.130" requesterDN="" instanceName="pingdirectory-elastic-test" threadID=125 conn=21 reason="I/O Error" msg="An error occurred while attempting to read data from the client:  SSLException: Unrecognized SSL message, plaintext connection? (SSLEngineInputRecord.java:145 SSLEngineInputRecord.java:64 SSLEngineImpl.java:612 SSLEngineImpl.java:506 SSLEngineImpl.java:482 SSLEngine.java:679 TLSConnectionSecurityProvider.java:1463 LDAPRequestHandler.java:240 DirectoryThread.java:358 (11.0.0.2-20260310181715.000Z-8b5f7f2b))"
@@ -0,0 +1,6 @@
+# newer versions go on top
+- version: '0.1.0'
+  changes:
+    - description: Add support of ldap_access datastream.
+      type: enhancement
+      link: https://github.com/elastic/integrations/pull/20091
@@ -0,0 +1,10 @@
+[25/May/2026:18:22:45.267 +0530] CONNECT instanceName="pingdirectory-elastic-test" threadID=198 conn=0 from="127.0.0.1" fromPort=44560 to="127.0.0.1" toPort=1636 protocol="LDAP+TLS" clientConnectionPolicy="default"
+[25/May/2026:18:22:45.382 +0530] SECURITY-NEGOTIATION requesterIP="127.0.0.1" instanceName="pingdirectory-elastic-test" threadID=124 conn=0 protocol="TLSv1.3" cipher="TLS_AES_256_GCM_SHA384" clientServerHandshakeTimeMillis="87.219" serverOnlyHandshakeTimeMillis="57.181"
+[25/May/2026:18:22:45.408 +0530] BIND RESULT instanceName="pingdirectory-elastic-test" threadID=10 conn=0 op=0 msgID=1 requesterIP="127.0.0.1" version="3" dn="" authType="SIMPLE" resultCode=0 resultCodeName="Success" qtime=0 etime=7.884 clientConnectionPolicy="default"
+[25/May/2026:18:22:45.416 +0530] DISCONNECT requesterIP="127.0.0.1" requesterDN="" instanceName="pingdirectory-elastic-test" threadID=124 conn=0 reason="Client Unbind"
+[25/May/2026:18:27:23.530 +0530] EXTENDED RESULT instanceName="pingdirectory-elastic-test" threadID=29 conn=1 op=0 msgID=1 requesterIP="10.50.15.29" requesterDN="" usingAdminSessionWorkerThread=true requestOID="1.3.6.1.4.1.30221.2.6.13" requestType="Start Administrative Session Extended Request" resultCode=0 resultCodeName="Success" additionalInfo="clientName='config-tool' useDedicatedThreadPool=true" qtime=0 etime=3.381
+[25/May/2026:18:27:23.567 +0530] SEARCH RESULT instanceName="pingdirectory-elastic-test" threadID=29 conn=1 op=2 msgID=3 requesterIP="10.50.15.29" requesterDN="cn=Directory Manager,cn=Root DNs,cn=config" usingAdminSessionWorkerThread=true base="cn=System Information,cn=monitor" scope=0 filter="(objectClass=*)" attrs="instanceRoot" resultCode=0 resultCodeName="Success" qtime=0 etime=2.145 usedPrivileges="bypass-acl" preAuthZUsedPrivileges="use-admin-session" entriesReturned=1
+<30>1 2026-06-23T11:04:12.067Z ub20-50-15-29.cdsys.local PingDirectory 4292 text-access - [23/Jun/2026:16:34:12.067 +0530] SEARCH RESULT product="Directory Server" instanceName="pingdirectory-elastic-test" startupID="ajDlEQ==" conn=52 op=1 msgID=2 requesterIP="10.50.14.255" requesterDN="cn=Directory Manager,cn=Root DNs,cn=config" base="dc=example,dc=com" scope=2 filter="(objectClass=*)" attrs="ALL" resultCode=0 resultCodeName="Success" qtime=0 etime=0.913 usedPrivileges="bypass-acl" entriesReturned=12
+[25/May/2026:18:30:48.688 +0530] ADD RESULT instanceName="pingdirectory-elastic-test" threadID=9 conn=4 op=1 msgID=2 requesterIP="127.0.0.1" requesterDN="cn=Directory Manager,cn=Root DNs,cn=config" dn="ou=People,dc=example,dc=com" resultCode=0 resultCodeName="Success" qtime=0 etime=24.567 usedPrivileges="bypass-acl"
+[25/May/2026:18:32:55.559 +0530] ADD RESULT instanceName="pingdirectory-elastic-test" threadID=10 conn=5 op=1 msgID=2 requesterIP="127.0.0.1" requesterDN="cn=Directory Manager,cn=Root DNs,cn=config" dn="uid=john.doe,ou=People,dc=example,dc=com" resultCode=65 resultCodeName="Object Class Violation" message="Entry 'uid=john.doe,ou=People,dc=example,dc=com' violates the Directory Server schema configuration because it includes attribute 'department' which is not allowed by any of the object classes defined in that entry" qtime=1 etime=3.178 usedPrivileges="bypass-acl"
+[25/May/2026:19:29:51.686 +0530] DISCONNECT requesterIP="172.20.240.130" requesterDN="" instanceName="pingdirectory-elastic-test" threadID=125 conn=21 reason="I/O Error" msg="An error occurred while attempting to read data from the client:  SSLException: Unrecognized SSL message, plaintext connection? (SSLEngineInputRecord.java:145 SSLEngineInputRecord.java:64 SSLEngineImpl.java:612 SSLEngineImpl.java:506 SSLEngineImpl.java:482 SSLEngine.java:679 TLSConnectionSecurityProvider.java:1463 LDAPRequestHandler.java:240 DirectoryThread.java:358 (11.0.0.2-20260310181715.000Z-8b5f7f2b))"