[navnit-elastic]

Proposed commit message

google_workspace: add support for google vault event type as a new data stream

This adds support for the Google Vault audit event type as a new data stream to
enhance the overall visibility of data in the Google Workspace integration.

This changes includes updating navigation links in to the relevant dashboards.

Sanitized test case inputs were obtained from live Google Workspace instance
using the Admin SDK for Reports API[1].

[1] https://developers.google.com/workspace/admin/reports/reference/rest

Checklist

• I have reviewed tips for building integrations and this pull request is aligned with them.
• I have verified that all data streams collect metrics or logs.
• I have added an entry to my package's changelog.yml file.
• I have verified that Kibana version constraints are current according to guidelines.
• I have verified that any added dashboard complies with Kibana's Dashboard good practices

Author's Checklist

• [ ]

How to test this PR locally

--- Test results for package: google_workspace - START ---
╭──────────────────┬─────────────┬───────────┬───────────────────────────────────────────┬────────┬──────────────╮
│ PACKAGE          │ DATA STREAM │ TEST TYPE │ TEST NAME                                 │ RESULT │ TIME ELAPSED │
├──────────────────┼─────────────┼───────────┼───────────────────────────────────────────┼────────┼──────────────┤
│ google_workspace │ vault       │ pipeline  │ (ingest pipeline warnings test-vault.log) │ PASS   │ 342.211066ms │
│ google_workspace │ vault       │ pipeline  │ test-vault.log                            │ PASS   │ 267.916954ms │
╰──────────────────┴─────────────┴───────────┴───────────────────────────────────────────┴────────┴──────────────╯
--- Test results for package: google_workspace - END   ---
Done

--- Test results for package: google_workspace - START ---
╭──────────────────┬─────────────┬───────────┬───────────┬────────┬───────────────╮
│ PACKAGE          │ DATA STREAM │ TEST TYPE │ TEST NAME │ RESULT │  TIME ELAPSED │
├──────────────────┼─────────────┼───────────┼───────────┼────────┼───────────────┤
│ google_workspace │ vault       │ system    │ default   │ PASS   │ 59.014144083s │
╰──────────────────┴─────────────┴───────────┴───────────┴────────┴───────────────╯
--- Test results for package: google_workspace - END   ---
Done

Related issues

• Closes [Google Workspace]: Add support for Vault event type #13624

Screenshots

[elasticmachine]

Pinging @elastic/security-service-integrations (Team:Security-Service Integrations)

[elastic-vault-github-plugin-prod]

🚀 Benchmarks report

To see the full report comment with /test benchmark fullreport

[kcreddy]

/test

[elasticmachine]

💚 Build Succeeded

• Buildkite Build
• Commit: 938b3b3

History

• 💚 Build #25069 succeeded c91abc7
• 💚 Build #25067 succeeded ce96293

cc @navnit-elastic

[elastic-sonarqube]

Quality Gate passed

Issues
0 New issues
0 Fixed issues
0 Accepted issues

Measures
0 Security Hotspots
97.4% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube

[elastic-vault-github-plugin-prod]

Package google_workspace - 2.39.0 containing this change is available at https://epr.elastic.co/package/google_workspace/2.39.0/

[leandrojmp]

@kcreddy any reason to lock this change behind Kibana 8.18.X? can this be backported to 8.17.X?

we were waiting for this dataset but cannot upgrade the integration as we are still on 8.17.X, we cannot upgrade at the moment as we do not upgrade to .0 releases.

[kcreddy]

@kcreddy any reason to lock this change behind Kibana 8.18.X? can this be backported to 8.17.X?

we were waiting for this dataset but cannot upgrade the integration as we are still on 8.17.X, we cannot upgrade at the moment as we do not upgrade to .0 releases.

Ideally we only backport bug-fixes to previous minor versions. But this PR is an enhancement.
The minimum kibana.version: 8.18.0 requirement came in #12921 as part of using the agentless deployment modes (which got introduced in 8.18 stack).
There are many data streams which we added after making kibana.version: 8.18.0, such as Data Studio, Calendar, Chat, and Vault along with few other enhancements as well. Do you need all of them to be backported to 8.17.x?

I will leave it to @jamiehynds to take the call if we need to backport.

[leandrojmp]

@kcreddy Personally I'm only interested in the Vault dataset at the moment.

We are going to upgrade once 8.18.1 gets released, if it is not that far from release, then we could wait.

[kcreddy]

We are going to upgrade once 8.18.1 gets released, if it is not that far from release, then we could wait.

@leandrojmp Yes, its actually going to be released very soon. Thanks for the patience to wait on this feature until 8.18.1 👍🏼