ssi_many: dashboard controls query all of logs-* instead of the integration's dataset #17567

Many integration dashboards use Kibana Controls (dropdown filters) that query the broad logs-* data view without a dashboard-level data_stream.dataset filter. This means the control dropdowns show values from unrelated data sources, and selecting a value can pull in data from other integrations.

Some of these dashboards do have per-panel Lens filters for data_stream.dataset, but Controls don't inherit panel-level Lens filters -- they rely on the dashboard-level search source. When that search source has an empty filter array, the controls are unscoped.

This was originally reported for the Azure Network Watcher NSG dashboard, but the same pattern exists across many dashboards.

Root cause

The dashboard JSON has:

"kibanaSavedObjectMeta": {
    "searchSourceJSON": {
        "filter": [],
        "query": { "language": "kuery", "query": "" }
    }
}

The empty filter array means Controls query all of logs-*. The fix is to add a data_stream.dataset filter at the dashboard level, which 401 other dashboards in this repo already do correctly.

Affected dashboards

51 packages, 172 dashboards total.

Notes

• Some dashboards cover multiple data streams (e.g. amazon_security_lake, cloudflare). The correct data_stream.dataset value(s) for the dashboard-level filter need to be determined per dashboard -- some may need a multi-value filter or a prefix match.
• Dashboards for metrics data streams (e.g. the AWS Load Balancer dashboard) should use metrics-* rather than logs-*, and the dataset filter logic may differ. Worth checking individually.
• The threat_map and ti_util dashboards intentionally span multiple datasets (they already have data_stream.dataset as a control field). These may be working as designed and could be excluded from the fix.