Skip to content

[New Integration] Cato Networks #18163

New issue
New issue
Closed
Enhancement
Closed
[New Integration] Cato Networks#18163
Enhancement
#19307 (+2)
Labels
CrestContributions from Crest developement team.Integration:cato_networksCato NetworksNew IntegrationIssue or pull request for creating a new integration package.enhancementNew feature or request

Description

@cpascale43
cpascale43
opened on Mar 31, 2026

Description

Cato Networks delivers a cloud-native Secure Access Service Edge (SASE) platform: SD-WAN, firewall, SWG, ZTNA, and related controls for sites, remote users, and cloud resources. Security and IT teams use Cato for network visibility, policy enforcement, and detection across WAN and internet-bound traffic.

The Elastic integration should ingest Cato audit logs (administrative/account activity) and events (security and operational events) for alerting and correlation use cases including: audit trail for admin and configuration changes; monitoring of firewall, access, and threat-related events; correlation with endpoint and identity data in Elastic Security; compliance reporting and evidence retention; and operational troubleshooting of policy and connectivity issues tied to event timelines.

Architecture

Primary path (expected): Pull-based collection via the Cato GraphQL API, authenticated with API credentials scoped to the account. The public schema exposes feed-oriented queries aligned with SIEM use cases:

Data type GraphQL (per API reference)
Administrative / account audit Query auditFeed — payload types include AccountAuditData, AuditFeed, per-record AuditRecord, with field metadata via AuditField / AuditFieldName
Security / operational events Query eventsFeed — payload types include EventsFeedData, EventsFeedAccountRecords, per-record EventRecord, with field metadata via EventField / EventFieldName

Activity

  1. cpascale43
    added
    enhancementNew feature or request
    New IntegrationIssue or pull request for creating a new integration package.
    Integration:cato_networksCato Networks
    on Mar 31, 2026
  2. cpascale43
    linked a pull request that will close this issue[Cato Networks][Audit] Add cato networks audit data-stream #17968on Mar 31, 2026
  3. cpascale43
    linked a pull request that will close this issue[Cato Networks][Event] Add cato networks event data-stream #17775on Mar 31, 2026

  4. github-actions commented on Mar 31, 2026

    @github-actions
    github-actionsBot
    on Mar 31, 2026 – with GitHub Actions
    Contributor

    tl;dr: I recommend treating this as a new package request and bootstrapping packages/cato_networks from the zscaler_zia pattern (multi-input + security-event mapping), then validating via the standard elastic-package/Buildkite gates.

    Recommendation

    Create a new integration package (not a variant of an existing one), using zscaler_zia as the primary implementation template and selectively reusing patterns from cloudflare_logpush and cisco_umbrella.

    I could not read the full issue body or related issue/PR content due integrity-policy filtering in this workflow, so this recommendation is based strictly on repository evidence.

    Findings
    • New package bootstrap is explicitly recommended via elastic-package create package:
      • docs/extend/build-create-package.md:8-14
    • Wizard output includes required package skeleton (manifest.yml, changelog.yml, docs template, validation):
      • docs/extend/build-create-package.md:26-33
    • zscaler_zia is a strong starting point for Cato-like SASE/security logs because it already supports multi-ingest modes (TCP + HTTP endpoint + API/CEL) in one policy template:
      • packages/zscaler_zia/manifest.yml:64-77
      • packages/zscaler_zia/manifest.yml:124-126
      • packages/zscaler_zia/manifest.yml:186-189
    • zscaler_zia firewall data stream demonstrates ECS-oriented parsing/mapping patterns suitable for security/firewall logs:
      • packages/zscaler_zia/data_stream/firewall/manifest.yml:1-8
      • packages/zscaler_zia/data_stream/firewall/elasticsearch/ingest_pipeline/default.yml:127-135
      • packages/zscaler_zia/data_stream/firewall/elasticsearch/ingest_pipeline/default.yml:190-193
      • packages/zscaler_zia/data_stream/firewall/elasticsearch/ingest_pipeline/default.yml:206-213
    • cloudflare_logpush provides reusable dedup handling for object-store delivery paths:
      • packages/cloudflare_logpush/data_stream/firewall_event/elasticsearch/ingest_pipeline/default.yml:25-35
    • CI gates for package checks/install/tests are enforced in Buildkite:
      • .buildkite/scripts/common.sh:884-885
      • .buildkite/scripts/common.sh:919-921
      • .buildkite/scripts/common.sh:930-950
    Verification

    I validated the referenced code paths directly in the workspace:

    $ rg -n "(?i)cato" packages/**/{manifest.yml,README.md,changelog.yml}
# no direct existing Cato package found

$ sed -n '64,189p' packages/zscaler_zia/manifest.yml
# confirms tcp/http_endpoint/cel inputs in one policy template

$ sed -n '120,220p' packages/zscaler_zia/data_stream/firewall/elasticsearch/ingest_pipeline/default.yml
# confirms ECS mapping flow (event.action, destination.ip, geoip, etc.)

$ sed -n '880,955p' .buildkite/scripts/common.sh
# confirms check/install/test gates in CI

    I also attempted to retrieve related issues/PR discussion, but GitHub read results were integrity-filtered in this run.

    Detailed Action Plan

    1. Scaffold the package:

      • Run elastic-package create package (per docs/extend/build-create-package.md:8-14).
      • Target folder: packages/cato_networks/.

    2. Fill minimum package metadata/spec requirements:

      • Ensure required root files and docs are present (manifest.yml, changelog.yml, docs/).
      • Use manifest requirements from docs/extend/manifest-spec.md (including owner).

    3. Implement v1 data streams with nearest-neighbor structure:

      • Start with firewall and audit-style logs.
      • Model data stream layout and pipeline conventions after:
        • packages/zscaler_zia/data_stream/firewall/*

    4. Support ingestion modes incrementally:

      • First: one reliable path (API/CEL or HTTP endpoint).
      • Then add optional additional transport(s) modeled on zscaler_zia/manifest.yml multi-input sections.

    5. Add dedup + schema safety controls:

      • Reuse dedup guard pattern from:
        • packages/cloudflare_logpush/data_stream/firewall_event/elasticsearch/ingest_pipeline/default.yml:25-35

    6. Add package docs + examples:

      • Provide _dev/build/docs/README.md and generated docs flow per build docs.

    7. Validate before PR:

      • elastic-package check
      • elastic-package test static
      • elastic-package test pipeline
      • (if applicable) elastic-package test system
      • Ensure repository CI gates align with .buildkite/scripts/common.sh:919-952.

    8. Open PR with explicit scope:

      • v1 streams, supported ingest mode(s), known gaps, and follow-up items.
    Related Items
    Type Path / Link Relevance
    File docs/extend/build-create-package.md Canonical new-package bootstrap path
    File packages/zscaler_zia/manifest.yml Best template for multi-input SASE/security integration
    File packages/zscaler_zia/data_stream/firewall/elasticsearch/ingest_pipeline/default.yml ECS mapping + parsing pattern for firewall events
    File packages/cloudflare_logpush/data_stream/firewall_event/elasticsearch/ingest_pipeline/default.yml Dedup pattern for object-store ingestion
    File .buildkite/scripts/common.sh CI enforcement of package check/install/test
    Issue/PR (unavailable in this run) GitHub issue/PR content was integrity-filtered

    Note

    🔒 Integrity filtering filtered 14 items

    Integrity filtering activated and filtered the following items during workflow execution.
    This happens when a tool call accesses a resource that does not meet the required integrity or secrecy level of the workflow.

    • issue:[New Integration] Cato Networks #18163 (issue_read: has lower integrity than agent requires. The agent cannot read data with integrity below "approved".)
    • #17968 (search_pull_requests: has lower integrity than agent requires. The agent cannot read data with integrity below "approved".)
    • #17775 (search_pull_requests: has lower integrity than agent requires. The agent cannot read data with integrity below "approved".)
    • #18163 (search_issues: has lower integrity than agent requires. The agent cannot read data with integrity below "approved".)
    • #12417 (search_pull_requests: has lower integrity than agent requires. The agent cannot read data with integrity below "approved".)
    • #17352 (search_issues: has lower integrity than agent requires. The agent cannot read data with integrity below "approved".)
    • #17525 (search_issues: has lower integrity than agent requires. The agent cannot read data with integrity below "approved".)
    • #15034 (search_issues: has lower integrity than agent requires. The agent cannot read data with integrity below "approved".)
    • #16625 (search_issues: has lower integrity than agent requires. The agent cannot read data with integrity below "approved".)
    • #14089 (search_issues: has lower integrity than agent requires. The agent cannot read data with integrity below "approved".)
    • #16060 (search_issues: has lower integrity than agent requires. The agent cannot read data with integrity below "approved".)
    • #11617 (search_issues: has lower integrity than agent requires. The agent cannot read data with integrity below "approved".)
    • #10169 (search_issues: has lower integrity than agent requires. The agent cannot read data with integrity below "approved".)
    • #14300 (search_issues: has lower integrity than agent requires. The agent cannot read data with integrity below "approved".)

    What is this? | From workflow: Issue Triage

    Give us feedback! React with 🚀 if perfect, 👍 if helpful, 👎 if not.

  5. cpascale43
    added
    CrestContributions from Crest developement team.
    on Mar 31, 2026
  6. cpascale43
    added the
    Enhancement
    issue type on Mar 31, 2026
  7. ilyannn
    closed this as completedin #19307on Jul 7, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Metadata

Metadata

Assignees

No one assigned

    Labels

    CrestContributions from Crest developement team.Integration:cato_networksCato NetworksNew IntegrationIssue or pull request for creating a new integration package.enhancementNew feature or request

    Type

    Enhancement

    Projects

    No projects

      Milestone

      No milestone

      Relationships

      None yet

      Development

      No branches or pull requests

      Issue actions