[cyberark_epm] Initial release of the CyberArk EPM by brijesh-elastic · Pull Request #12198 · elastic/integrations

brijesh-elastic · 2024-12-26T06:02:09Z

Proposed commit message

Create new integration package cyberark_epm.

Added raw_event, policyaudit_raw_event, aggregated_event, policyaudit_aggregated_event, admin_audit data streams.
Added data collection logic for all the data stream.
Added the ingest pipeline for all the data stream.
Mapped fields according to the ECS schema and added Fields metadata in the appropriate yml files.
Added dashboard and visualizations.
Added pipeline test for all the data stream.
Added system test cases for all the data stream.

Checklist

I have reviewed tips for building integrations and this pull request is aligned with them.
I have verified that all data streams collect metrics or logs.
I have added an entry to my package's changelog.yml file.
I have verified that Kibana version constraints are current according to guidelines.

How to test this PR locally

Clone integrations repo.
Install elastic package locally.
Start elastic stack using elastic-package.
Move to integrations/packages/cyberark_epm directory.
Run the following command to run tests.

elastic-package test

Run pipeline tests for the package
--- Test results for package: cyberark_epm - START ---
╭──────────────┬──────────────────────────────┬───────────┬──────────────────────────────────────────────────────────────────┬────────┬──────────────╮
│ PACKAGE      │ DATA STREAM                  │ TEST TYPE │ TEST NAME                                                        │ RESULT │ TIME ELAPSED │
├──────────────┼──────────────────────────────┼───────────┼──────────────────────────────────────────────────────────────────┼────────┼──────────────┤
│ cyberark_epm │ admin_audit                  │ pipeline  │ (ingest pipeline warnings test-admin-audit.log)                  │ PASS   │ 373.485081ms │
│ cyberark_epm │ admin_audit                  │ pipeline  │ test-admin-audit.log                                             │ PASS   │ 370.141027ms │
│ cyberark_epm │ aggregated_event             │ pipeline  │ (ingest pipeline warnings test-aggregated-event.log)             │ PASS   │ 348.158628ms │
│ cyberark_epm │ aggregated_event             │ pipeline  │ test-aggregated-event.log                                        │ PASS   │ 158.593808ms │
│ cyberark_epm │ policyaudit_aggregated_event │ pipeline  │ (ingest pipeline warnings test-policyaudit-aggregated-event.log) │ PASS   │  367.69165ms │
│ cyberark_epm │ policyaudit_aggregated_event │ pipeline  │ test-policyaudit-aggregated-event.log                            │ PASS   │ 151.219228ms │
│ cyberark_epm │ policyaudit_raw_event        │ pipeline  │ (ingest pipeline warnings test-policyaudit-raw-event.log)        │ PASS   │ 356.983904ms │
│ cyberark_epm │ policyaudit_raw_event        │ pipeline  │ test-policyaudit-raw-event.log                                   │ PASS   │ 289.167912ms │
│ cyberark_epm │ raw_event                    │ pipeline  │ (ingest pipeline warnings test-raw-event.log)                    │ PASS   │ 386.064945ms │
│ cyberark_epm │ raw_event                    │ pipeline  │ test-raw-event.log                                               │ PASS   │ 398.094142ms │
╰──────────────┴──────────────────────────────┴───────────┴──────────────────────────────────────────────────────────────────┴────────┴──────────────╯
--- Test results for package: cyberark_epm - END   ---
Done
--- Test results for package: cyberark_epm - START ---
╭──────────────┬──────────────────────────────┬───────────┬───────────┬────────┬─────────────────╮
│ PACKAGE      │ DATA STREAM                  │ TEST TYPE │ TEST NAME │ RESULT │    TIME ELAPSED │
├──────────────┼──────────────────────────────┼───────────┼───────────┼────────┼─────────────────┤
│ cyberark_epm │ admin_audit                  │ system    │ default   │ PASS   │ 1m14.822078529s │
│ cyberark_epm │ aggregated_event             │ system    │ default   │ PASS   │   39.598617731s │
│ cyberark_epm │ policyaudit_aggregated_event │ system    │ default   │ PASS   │   37.719638227s │
│ cyberark_epm │ policyaudit_raw_event        │ system    │ default   │ PASS   │   39.685396146s │
│ cyberark_epm │ raw_event                    │ system    │ default   │ PASS   │   37.535405773s │
╰──────────────┴──────────────────────────────┴───────────┴───────────┴────────┴─────────────────╯
--- Test results for package: cyberark_epm - END   ---
Done
Run static tests for the package
--- Test results for package: cyberark_epm - START ---
╭──────────────┬──────────────────────────────┬───────────┬──────────────────────────┬────────┬──────────────╮
│ PACKAGE      │ DATA STREAM                  │ TEST TYPE │ TEST NAME                │ RESULT │ TIME ELAPSED │
├──────────────┼──────────────────────────────┼───────────┼──────────────────────────┼────────┼──────────────┤
│ cyberark_epm │ admin_audit                  │ static    │ Verify sample_event.json │ PASS   │ 158.696836ms │
│ cyberark_epm │ aggregated_event             │ static    │ Verify sample_event.json │ PASS   │ 153.751514ms │
│ cyberark_epm │ policyaudit_aggregated_event │ static    │ Verify sample_event.json │ PASS   │ 125.980695ms │
│ cyberark_epm │ policyaudit_raw_event        │ static    │ Verify sample_event.json │ PASS   │ 159.407462ms │
│ cyberark_epm │ raw_event                    │ static    │ Verify sample_event.json │ PASS   │ 158.827029ms │
╰──────────────┴──────────────────────────────┴───────────┴──────────────────────────┴────────┴──────────────╯
--- Test results for package: cyberark_epm - END   ---
Done
--- Test results for package: cyberark_epm - START ---
╭──────────────┬──────────────────────────────┬───────────┬────────────────────────────────────────────────────────────────────────────────┬────────┬──────────────╮
│ PACKAGE      │ DATA STREAM                  │ TEST TYPE │ TEST NAME                                                                      │ RESULT │ TIME ELAPSED │
├──────────────┼──────────────────────────────┼───────────┼────────────────────────────────────────────────────────────────────────────────┼────────┼──────────────┤
│ cyberark_epm │                              │ asset     │ dashboard cyberark_epm-235e1190-62b9-4d30-99d9-f6d640a5065f is loaded          │ PASS   │      1.297µs │
│ cyberark_epm │                              │ asset     │ dashboard cyberark_epm-503ef0b0-fbbb-458c-96a1-e6a5d9f5810a is loaded          │ PASS   │        296ns │
│ cyberark_epm │                              │ asset     │ dashboard cyberark_epm-b015df85-92b5-450a-91d4-4ff8bd9505f4 is loaded          │ PASS   │        286ns │
│ cyberark_epm │                              │ asset     │ search cyberark_epm-289b72be-f568-4132-a4ed-6d8a36c76b0f is loaded             │ PASS   │        352ns │
│ cyberark_epm │                              │ asset     │ search cyberark_epm-d203e565-1dba-4de2-801c-9158f90d4445 is loaded             │ PASS   │        298ns │
│ cyberark_epm │                              │ asset     │ search cyberark_epm-d459827d-4bc4-4ca8-85a2-7466fceff573 is loaded             │ PASS   │        276ns │
│ cyberark_epm │ admin_audit                  │ asset     │ index_template logs-cyberark_epm.admin_audit is loaded                         │ PASS   │        369ns │
│ cyberark_epm │ admin_audit                  │ asset     │ ingest_pipeline logs-cyberark_epm.admin_audit-0.1.0 is loaded                  │ PASS   │        238ns │
│ cyberark_epm │ aggregated_event             │ asset     │ index_template logs-cyberark_epm.aggregated_event is loaded                    │ PASS   │        528ns │
│ cyberark_epm │ aggregated_event             │ asset     │ ingest_pipeline logs-cyberark_epm.aggregated_event-0.1.0 is loaded             │ PASS   │        220ns │
│ cyberark_epm │ policyaudit_aggregated_event │ asset     │ index_template logs-cyberark_epm.policyaudit_aggregated_event is loaded        │ PASS   │        259ns │
│ cyberark_epm │ policyaudit_aggregated_event │ asset     │ ingest_pipeline logs-cyberark_epm.policyaudit_aggregated_event-0.1.0 is loaded │ PASS   │        182ns │
│ cyberark_epm │ policyaudit_raw_event        │ asset     │ index_template logs-cyberark_epm.policyaudit_raw_event is loaded               │ PASS   │        288ns │
│ cyberark_epm │ policyaudit_raw_event        │ asset     │ ingest_pipeline logs-cyberark_epm.policyaudit_raw_event-0.1.0 is loaded        │ PASS   │        155ns │
│ cyberark_epm │ raw_event                    │ asset     │ index_template logs-cyberark_epm.raw_event is loaded                           │ PASS   │        231ns │
│ cyberark_epm │ raw_event                    │ asset     │ ingest_pipeline logs-cyberark_epm.raw_event-0.1.0 is loaded                    │ PASS   │        201ns │
╰──────────────┴──────────────────────────────┴───────────┴────────────────────────────────────────────────────────────────────────────────┴────────┴──────────────╯
--- Test results for package: cyberark_epm - END   ---
Done

Related issues

Closes [New integration] CyberArk EPM #11795

Screenshots

elastic-vault-github-plugin-prod · 2024-12-26T06:26:07Z

🚀 Benchmarks report

To see the full report comment with /test benchmark fullreport

packages/cyberark_epm/_dev/build/docs/README.md

packages/cyberark_epm/data_stream/admin_audit/agent/stream/cel.yml.hbs

..._epm/data_stream/aggregated_event/_dev/test/pipeline/test-aggregated-event.log-expected.json

...udit_aggregated_event/_dev/test/pipeline/test-policyaudit-aggregated-event.log-expected.json

packages/cyberark_epm/data_stream/admin_audit/manifest.yml

kcreddy · 2025-01-06T06:50:14Z

packages/cyberark_epm/_dev/build/docs/README.md

Add API Version to this list as it is important for fetching data.

elasticmachine · 2025-01-06T13:58:20Z

💚 Build Succeeded

Buildkite Build
Commit: caac4dec90fea9cf93ba0f3903fd896be2558024

History

💚 Build #20037 succeeded de5eb90f95b54d2831f9a6115b7565cf7728f051
💚 Build #19839 succeeded fb67dd4f11a0c9db9fc98fe1a67a6ab5d7b6ae0b

elastic-sonarqube · 2025-01-06T13:58:28Z

Quality Gate passed

Issues
0 New issues
0 Fixed issues
0 Accepted issues

Measures
0 Security Hotspots
93.4% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube

elastic-vault-github-plugin-prod · 2025-01-06T15:44:04Z

Package cyberark_epm - 0.1.0 containing this change is available at https://epr.elastic.co/package/cyberark_epm/0.1.0/

Create new integration package cyberark_epm. Added raw_event, policyaudit_raw_event, aggregated_event, policyaudit_aggregated_event, admin_audit data streams. Added data collection logic for all the data stream. Added the ingest pipeline for all the data stream. Mapped fields according to the ECS schema and added Fields metadata in the appropriate yml files. Added dashboard and visualizations. Added pipeline test for all the data stream. Added system test cases for all the data stream.

andrewkroh added Crest Contributions from Crest developement team. Integration:cyberark_epm CyberArk EPM New Integration Issue or pull request for creating a new integration package. labels Dec 26, 2024

kcreddy reviewed Dec 31, 2024

View reviewed changes

brijesh-elastic requested a review from kcreddy January 6, 2025 06:25

kcreddy reviewed Jan 6, 2025

View reviewed changes

kcreddy approved these changes Jan 6, 2025

View reviewed changes

kcreddy merged commit 8785e9a into elastic:main Jan 6, 2025

brijesh-elastic deleted the package_cyberark_epm branch February 8, 2025 07:29

efd6 mentioned this pull request Mar 7, 2025

ssi: add support for request trace deletion #13002

Open

33 tasks

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

[cyberark_epm] Initial release of the CyberArk EPM#12198

[cyberark_epm] Initial release of the CyberArk EPM#12198
kcreddy merged 0 commit intoelastic:mainfrom
brijesh-elastic:package_cyberark_epm

brijesh-elastic commented Dec 26, 2024

Uh oh!

elastic-vault-github-plugin-prod bot commented Dec 26, 2024

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

kcreddy Jan 6, 2025

Uh oh!

elasticmachine commented Jan 6, 2025

Uh oh!

elastic-sonarqube bot commented Jan 6, 2025

Uh oh!

elastic-vault-github-plugin-prod bot commented Jan 6, 2025

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

5 participants

Conversation

brijesh-elastic commented Dec 26, 2024

Proposed commit message

Checklist

How to test this PR locally

Related issues

Screenshots

Uh oh!

elastic-vault-github-plugin-prod bot commented Dec 26, 2024

🚀 Benchmarks report

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

kcreddy Jan 6, 2025

Choose a reason for hiding this comment

Uh oh!

elasticmachine commented Jan 6, 2025

💚 Build Succeeded

History

Uh oh!

elastic-sonarqube bot commented Jan 6, 2025

Quality Gate passed

Uh oh!

elastic-vault-github-plugin-prod bot commented Jan 6, 2025

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

5 participants