x-pack/filebeat/input/entityanalytics/provider/okta: collect enrolled devices for users

[chemamartinez]

Proposed commit message

x-pack/filebeat/input/entityanalytics/provider/okta: collect enrolled devices for users

Adds enrolled_devices as a new optional value for the enrich_with
configuration option in the Okta entity analytics provider. When enabled,
each user is enriched with the list of devices enrolled for that user via
the List User Devices[1] Okta API endpoint (GET /api/v1/users/{userId}/devices).

The enrichment is opt-in and excluded from the default configuration to avoid
the extra per-user API call that would increase Okta rate limit consumption.
The enrolled devices are published in the devices field of the user event,
following the same pattern as existing enrichments (groups, roles, factors).

[1]: https://developer.okta.com/docs/api/openapi/okta-management/management/tags/userresources/other/listuserdevices

Checklist

• My code follows the style guidelines of this project
• I have commented my code, particularly in hard-to-understand areas
• I have made corresponding changes to the documentation
• I have made corresponding change to the default configuration files
• I have added tests that prove my fix is effective or that my feature works. Where relevant, I have used the stresstest.sh script to run them under stress conditions and race detector to verify their stability.
• I have added an entry in ./changelog/fragments using the changelog tool.

Related issues

• Closes x-pack/filebeat/input/entityanalytics/provider/okta: add enrichment to obtain owns relationship #49780

[github-actions]

🤖 GitHub comments

Just comment with:

• run docs-build : Re-trigger the docs validation. (use unformatted text in the comment!)

[mergify]

This pull request does not have a backport label.
If this is a bug or security fix, could you label this PR @chemamartinez? 🙏.
For such, you'll need to label your PR with:

• The upcoming major version of the Elastic Stack
• The upcoming minor version of the Elastic Stack (if you're not pushing a breaking change)

To fixup this pull request, you need to add the backport labels for the needed
branches, such as:

• backport-8./d is the label to automatically backport to the 8./d branch. /d is the digit
• backport-active-all is the label that automatically backports to all active branches.
• backport-active-8 is the label that automatically backports to all active minor branches for the 8 major.
• backport-active-9 is the label that automatically backports to all active minor branches for the 9 major.

[elasticmachine]

Pinging @elastic/security-service-integrations (Team:Security-Service Integrations)

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro

Run ID: 2c44f6ed-4b22-4995-a5f0-d3a467f9ec73

📥 Commits

Reviewing files that changed from the base of the PR and between 4f02c27 and 17be832.

📒 Files selected for processing (5)

• docs/reference/filebeat/filebeat-input-entity-analytics.md
• x-pack/filebeat/input/entityanalytics/provider/okta/conf.go
• x-pack/filebeat/input/entityanalytics/provider/okta/internal/okta/okta.go
• x-pack/filebeat/input/entityanalytics/provider/okta/okta.go
• x-pack/filebeat/input/entityanalytics/provider/okta/okta_test.go

🚧 Files skipped from review as they are similar to previous changes (3)

• x-pack/filebeat/input/entityanalytics/provider/okta/okta.go
• x-pack/filebeat/input/entityanalytics/provider/okta/conf.go
• x-pack/filebeat/input/entityanalytics/provider/okta/okta_test.go

---

📝 Walkthrough

Walkthrough

Introduces an opt-in devices enrichment (alias enrolled_devices) for the Okta entity analytics provider. When enabled, Filebeat calls Okta’s List User Devices API per user and attaches returned devices to each user record. Adds GetUserDevices, persists a Devices []okta.Device field in the user state-store, includes devices in published user documents, updates config/docs/comments to list devices, extends tests, and adds a changelog fragment. The enrichment is disabled by default.

🚥 Pre-merge checks | ✅ 2

✅ Passed checks (2 passed)

Check name	Status	Explanation
Linked Issues check	✅ Passed	PR successfully implements all objectives from #49780: adds optional device enrichment via Okta's List User Devices API endpoint, excludes from defaults to avoid rate-limit pressure, and follows existing enrichment patterns.
Out of Scope Changes check	✅ Passed	All changes are directly scoped to device enrichment feature: documentation updates, configuration field updates, API wrapper function, enrichment logic, state persistence, and tests.

_{✏️ Tip: You can configure your own custom pre-merge checks in the settings.}

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests

• 🛠️ Update Documentation: Commit on current branch
• 🛠️ Update Documentation: Create PR

---

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

[efd6]

Query only then LGTM

[mergify]

This pull request does not have a backport label.
If this is a bug or security fix, could you label this PR @chemamartinez? 🙏.
For such, you'll need to label your PR with:

• The upcoming major version of the Elastic Stack
• The upcoming minor version of the Elastic Stack (if you're not pushing a breaking change)

To fixup this pull request, you need to add the backport labels for the needed
branches, such as:

• backport-8./d is the label to automatically backport to the 8./d branch. /d is the digit
• backport-active-all is the label that automatically backports to all active branches.
• backport-active-8 is the label that automatically backports to all active minor branches for the 8 major.
• backport-active-9 is the label that automatically backports to all active minor branches for the 9 major.

[mergify]

This pull request is now in conflicts. Could you fix it? 🙏
To fixup this pull request, you can check out it locally. See documentation: https://help.github.com/articles/checking-out-pull-requests-locally/

git fetch upstream
git checkout -b 49780-entityanalytics_okta-get-enrolled-devices upstream/49780-entityanalytics_okta-get-enrolled-devices
git merge upstream/main
git push upstream 49780-entityanalytics_okta-get-enrolled-devices