Skip to content

[New Integration] XM Cyber #18530

New issue
New issue
Closed
Enhancement
Closed
[New Integration] XM Cyber#18530
Enhancement
Labels
CrestContributions from Crest developement team.New IntegrationIssue or pull request for creating a new integration package.enhancementNew feature or request

Description

@cpascale43
cpascale43
opened on Apr 20, 2026

Description

Create an XM Cyber integration that ingests exposure findings, entity inventory, audit trail and security risk score data into Elastic, enabling attack path visibility, vulnerability prioritization and compliance use cases.

Sample data available upon request.

Required data

Field availability to be confirmed against XM Cyber API responses.

XM Cyber Field Expected ECS Mapping Availability Notes
Entity name host.name / user.name Type-dependent (Device vs. AD User)
Entity type labels.entity_type Device, AD User, AD Security Group, etc.
Compromised status event.outcome Compromised / Not compromised
Compromise risk score labels.compromise_risk_score 0–100
Choke point score labels.choke_point_score
Affected critical assets count labels.critical_assets_count
IP address host.ip Visible in entity detail table
Exposure name event.action e.g., PrintNightmare, AD DCSync
Exposure type labels.exposure_type e.g., hackingTechnique
Exposure severity vulnerability.severity Critical, High, Medium, Low, Informative
Critical assets at risk labels.critical_assets_at_risk
CVE ID vulnerability.id VRM — visible in vulnerability detail table
CVSS v4.0 vulnerability.score.base VRM
Scenario name labels.scenario_name
Scenario risk grade labels.risk_grade A–F scale
Scenario risk score labels.risk_score 0–100
Audit event type event.type e.g., ACCESS
Audit event subtype event.action e.g., XM_LOGIN, LOGOUT
Audit username user.name
Audit user email user.email
Audit source IP source.ip
Sensor name host.name
Sensor status labels.sensor_status active / inactive
Organization security score labels.security_score Main dashboard score, 0–100

Dashboard ideas

  • Entities Overview: Total entities, critical assets, and choke points; distribution by compromised status and severity; most impacted entities table
  • Scenario Exposure Findings: Exposures with most risk to critical assets and choke points; exposure profile detail with severity, complexity, and affected entities
  • Security Score Trend: Organization-wide risk score over time (1 month / 3 month / 6 month / 1 year views)
  • Audit Trail: Most active users, user activity distribution, 2FA setup trend, most active IPs, audit detail log
  • Scenarios Overview: Risk grade distribution, inactive scenario count, lowest-scoring scenarios, scenario detail table
  • Sensors Overview: Sensors by OS type and cloud provider, failed sensors by reason, sensors requiring updates, version distribution
  • VRM — Vulnerabilities / Devices / Products: CVE inventory by severity and age, new vs. remediated trend, vulnerability funnel by XM enrichment; device and product detail tables with choke point and critical asset context

Use cases

  • Attack path correlation: Combine XM Cyber choke point and critical asset data with EDR telemetry to prioritize alert triage based on whether the affected entity sits on an active attack path
  • Exposure driven vulnerability prioritization: XM Cyber's VRM surfaces CVEs already enriched with attack path context, enabling SOC teams to prioritize remediation by actual risk rather than CVSS alone
  • Entity risk scoring: Use compromise risk scores and choke point status as signals in Elastic's user and entity risk scoring framework

Activity

  1. cpascale43
    added
    enhancementNew feature or request
    New IntegrationIssue or pull request for creating a new integration package.
    CrestContributions from Crest developement team.
    on Apr 20, 2026
  2. cpascale43
    added the
    Enhancement
    issue type on Apr 20, 2026

  3. github-actions commented on Apr 20, 2026

    @github-actions
    github-actionsBot
    on Apr 20, 2026 – with GitHub Actions
    Contributor

    tl;dr: I recommend treating this as a net-new integration request and starting with a scaffold PR for packages/xm_cyber modeled on packages/cyera, because no XM Cyber package exists in this repo and CI requires package check/install/test gates from day one.

    Recommendation

    Create an initial PR that only scaffolds the XM Cyber package (manifest, one CEL-based logs data stream, docs skeleton, validation, and baseline tests), then iterate on additional data streams in follow-up PRs.

    Findings

    1. No existing XM Cyber package in-repo

      • packages/ search returned no xm, xmcyber, or xm-cyber package directory.
      • Content search under packages/ for xm cyber|xm_cyber|xmcyber returned no matches.

    2. Best structural template is cyera (same API-polling / security-posture style integration)

      • packages/cyera/manifest.yml:36-51 defines a CEL input policy template with API collection.
      • packages/cyera/manifest.yml:53-74 shows credential var patterns (url, client_id, client_secret).
      • packages/cyera/data_stream/issue/manifest.yml:1-8 and :10-33 show logs data stream and polling/batch vars.
      • packages/cyera/data_stream/issue/elasticsearch/ingest_pipeline/default.yml:35-43 shows parse + event classification patterns.

    3. Repository process/CI expectations for new packages are explicit

      • Package scaffolding guidance: docs/extend/build-create-package.md:8-31, :57-73.
      • PR expectations including title/changelog/tests: docs/extend/_publish_an_integration.md:11-22, :54-56.
      • Package checks/install/tests in CI: .buildkite/scripts/common.sh:835-840, :930-950.
      • Changed packages are tested in per-package pipeline steps: .buildkite/scripts/trigger_integrations_in_parallel.sh:54-83.

    4. Checklist precedent for new integrations

      • .github/ISSUE_TEMPLATE/integration-checklist.md:12-20, :24-37.

    5. Known environment limitation while triaging

      • I could not read issue body/comments or related issue details through MCP due integrity filtering in this run, so this recommendation is based on repository evidence + issue title.
    Verification 
    $ find packages -maxdepth 1 -type d | grep -Ei "xm|xmcyber|xm-cyber"
# (no output)

$ find packages/cyera -maxdepth 3 -type f | grep -E "manifest.yml|sample_event.json|docs/README.md|validation.yml" | head -n 20
packages/cyera/data_stream/datastore/sample_event.json
packages/cyera/data_stream/datastore/manifest.yml
packages/cyera/data_stream/issue/sample_event.json
packages/cyera/data_stream/issue/manifest.yml
packages/cyera/data_stream/event/sample_event.json
packages/cyera/data_stream/event/manifest.yml
packages/cyera/data_stream/classification/sample_event.json
packages/cyera/data_stream/classification/manifest.yml
packages/cyera/validation.yml
packages/cyera/docs/README.md
packages/cyera/manifest.yml
    Detailed Action Plan
    1. Generate package scaffold with elastic-package create package and name it xm_cyber (docs/extend/build-create-package.md:12-14, :26-33).
    2. Add an initial CEL logs data stream via elastic-package create data-stream (docs/extend/build-create-package.md:59-63, :67-70).
    3. Mirror cyera API auth/input conventions in packages/xm_cyber/manifest.yml (reference: packages/cyera/manifest.yml:36-74).
    4. Implement first ingest pipeline and ECS mapping using the cyera/issue pattern (reference: packages/cyera/data_stream/issue/elasticsearch/ingest_pipeline/default.yml:35-43).
    5. Add baseline artifacts required for CI/review: docs/README.md, validation.yml, sample_event.json, and _dev/test fixtures (reference structure visible under packages/cyera/**).
    6. Add changelog entry and PR metadata, then run elastic-package check and elastic-package test before opening PR (docs/extend/_publish_an_integration.md:11-22; CI enforcement in .buildkite/scripts/common.sh:835-840, :930-950).
    7. Use the integration release checklist as acceptance criteria (.github/ISSUE_TEMPLATE/integration-checklist.md:12-20, :24-37).
    Related Items
    Type Link / File Relevance
    Issue #18530 Source request ([New Integration] XM Cyber)
    File packages/cyera/manifest.yml Closest template for API/CEL security integration
    File packages/cyera/data_stream/issue/manifest.yml Example initial logs stream config
    File packages/cyera/data_stream/issue/elasticsearch/ingest_pipeline/default.yml Example ingest mapping/error-handling pattern
    File docs/extend/build-create-package.md Official package/data-stream creation flow
    File docs/extend/_publish_an_integration.md PR/test/changelog requirements
    File .buildkite/scripts/common.sh Enforced check/install/test CI gates
    File .github/ISSUE_TEMPLATE/integration-checklist.md Standard checklist for new integrations
    PR https://github.com/elastic/integrations/pull/18408 Example initial-release reference (from packages/microsoft_intune/changelog.yml:6)

    Note

    🔒 Integrity filter blocked 19 items

    The following items were blocked because they don't meet the GitHub integrity level.

    • #18530 search_issues: has lower integrity than agent requires. The agent cannot read data with integrity below "approved".
    • #18530 issue_read: has lower integrity than agent requires. The agent cannot read data with integrity below "approved".
    • #18509 search_issues: has lower integrity than agent requires. The agent cannot read data with integrity below "approved".
    • #18166 search_issues: has lower integrity than agent requires. The agent cannot read data with integrity below "approved".
    • #18165 search_issues: has lower integrity than agent requires. The agent cannot read data with integrity below "approved".
    • #18164 search_issues: has lower integrity than agent requires. The agent cannot read data with integrity below "approved".
    • #18163 search_issues: has lower integrity than agent requires. The agent cannot read data with integrity below "approved".
    • #17525 search_issues: has lower integrity than agent requires. The agent cannot read data with integrity below "approved".
    • #17352 search_issues: has lower integrity than agent requires. The agent cannot read data with integrity below "approved".
    • #16983 search_issues: has lower integrity than agent requires. The agent cannot read data with integrity below "approved".
    • #16945 search_issues: has lower integrity than agent requires. The agent cannot read data with integrity below "approved".
    • #16625 search_issues: has lower integrity than agent requires. The agent cannot read data with integrity below "approved".
    • #16060 search_issues: has lower integrity than agent requires. The agent cannot read data with integrity below "approved".
    • #15987 search_issues: has lower integrity than agent requires. The agent cannot read data with integrity below "approved".
    • #15444 search_issues: has lower integrity than agent requires. The agent cannot read data with integrity below "approved".
    • #15133 search_issues: has lower integrity than agent requires. The agent cannot read data with integrity below "approved".
    • ... and 3 more items

    To allow these resources, lower min-integrity in your GitHub frontmatter:

    tools:
  github:
    min-integrity: approved  # merged | approved | unapproved | none

    What is this? | From workflow: Issue Triage

    Give us feedback! React with 🚀 if perfect, 👍 if helpful, 👎 if not.

  4. jamiehynds
    closed this as completedon Jul 27, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Metadata

Metadata

Assignees

No one assigned

    Labels

    CrestContributions from Crest developement team.New IntegrationIssue or pull request for creating a new integration package.enhancementNew feature or request

    Type

    Enhancement

    Projects

    No projects

      Milestone

      No milestone

      Relationships

      None yet

      Development

      No branches or pull requests

      Issue actions