Module preprocess_entities 

Entity mapping preprocessor.

⚠️ DEPRECATED: Use entity-analysis preprocess instead.

# Old (deprecated):
vault-audit preprocess-entities logs/*.log --output mappings.json

# New (recommended):
vault-audit entity-analysis preprocess logs/*.log --output mappings.json

Note: Most commands now auto-preprocess entity mappings, so this is rarely needed!

See entity_analysis for the unified command.

---

Extracts entity-to-alias mappings from audit logs and exports to JSON or CSV, creating a baseline for subsequent entity analysis. Supports multi-file processing for comprehensive entity mapping.

Usage

# Single file preprocessing (JSON default)
vault-audit preprocess-entities audit.log --output entity-mappings.json

# Multi-day comprehensive mapping (CSV)
vault-audit preprocess-entities logs/*.log --output entity-mappings.csv --format csv

# JSON format for entity-creation command
vault-audit preprocess-entities logs/*.log --output entity-mappings.json --format json

Output

Generates JSON or CSV containing:

• Entity ID
• Display name
• Mount path and accessor
• Username (if available)
• Login count
• First and last seen timestamps

This output can be used as a baseline for:

• entity-creation command (accepts both CSV and JSON)
• client-activity command (JSON format)
• External analysis tools
• Historical trending

Structs

EntityMapping

Entity mapping with login statistics

Functions

build_entity_map

Build entity mappings from audit logs without writing to file. Returns HashMap of entity_id -> EntityMapping for reuse by other commands.

run