[muskan-agarwal26]

Proposed commit message

1. Update cel code and manifest to use asset_type_list var
2. Remove event.data.* and map fields on root level.
3. Remove drop event from pipeline
4. Update transform frequency to 90d for assets
5. ILM retention to 30d for assets
6. Add visual level filter in dashboard
7. Add remove inside on_failure in convert processor
8. Change tenant_number field type to long and description/summary field type to text
9. Add fingerprint description and code comments in transform, as added in network datastream
10. Add note in overview of dashboard for assets
11. Update the if condition in all pipeline processors to be in the format: ctx.axonius?.asset_type == pattern

Checklist

• I have reviewed tips for building integrations and this pull request is aligned with them.
• I have verified that all data streams collect metrics or logs.
• I have added an entry to my package's changelog.yml file.
• I have verified that Kibana version constraints are current according to guidelines.
• I have verified that any added dashboard complies with Kibana's Dashboard good practices

How to test this PR locally

To test the Axonius package:

• Clone integrations repo.
• Install elastic package locally.
• Start elastic stack using elastic-package.
• Move to integrations/packages/axonius directory.
• Run the following command to run tests.

Related issues

• Relates [New Integration] Axonius #15034

[github-actions]

Elastic Docs Style Checker (Vale)

Summary: 21 warnings, 7 suggestions found

⚠️ Warnings (21): Fix when the suggestion improves clarity or correctness.

File	Line	Rule	Message
packages/axonius/_dev/build/docs/README.md	5	Elastic.EndPuntuaction	Don't end headings with punctuation.
packages/axonius/_dev/build/docs/README.md	128	Elastic.MenuArrowsBold	Use '→' to separate menu items, not '' or '='. Example: Select Manage index → Add lifecycle policy.
packages/axonius/_dev/build/docs/README.md	128	Elastic.MenuArrows	Use '→' to separate menu items, not '' or '='. Example: Select Manage index → Add lifecycle policy.
packages/axonius/_dev/build/docs/README.md	165	Elastic.Latinisms	Latin terms and abbreviations are a common source of confusion. Use 'and so on' instead of 'etc'.
packages/axonius/_dev/build/docs/README.md	183	Elastic.DirectionalLanguage	Don't use directional language. Use 'the following element' instead of 'the table below'.
packages/axonius/data_stream/identity/fields/fields.yml	78	Elastic.Latinisms	Latin terms and abbreviations are a common source of confusion. Use 'for example' instead of 'e.g'.
packages/axonius/data_stream/identity/fields/fields.yml	183	Elastic.Latinisms	Latin terms and abbreviations are a common source of confusion. Use 'for example' instead of 'e.g'.
packages/axonius/data_stream/identity/fields/fields.yml	324	Elastic.Latinisms	Latin terms and abbreviations are a common source of confusion. Use 'for example' instead of 'e.g'.
packages/axonius/data_stream/identity/fields/fields.yml	447	Elastic.Accessibility	Don't use language such as 'non-verbal' that defines people by their disability.
packages/axonius/data_stream/identity/fields/fields.yml	660	Elastic.Latinisms	Latin terms and abbreviations are a common source of confusion. Use 'for example' instead of 'e.g'.
packages/axonius/data_stream/identity/fields/fields.yml	753	Elastic.Latinisms	Latin terms and abbreviations are a common source of confusion. Use 'for example' instead of 'e.g'.
packages/axonius/data_stream/identity/fields/fields.yml	807	Elastic.Latinisms	Latin terms and abbreviations are a common source of confusion. Use 'for example' instead of 'e.g'.
packages/axonius/data_stream/identity/fields/fields.yml	849	Elastic.Latinisms	Latin terms and abbreviations are a common source of confusion. Use 'for example' instead of 'e.g'.
packages/axonius/data_stream/identity/fields/fields.yml	1245	Elastic.Latinisms	Latin terms and abbreviations are a common source of confusion. Use 'for example' instead of 'e.g'.
packages/axonius/data_stream/identity/fields/fields.yml	1275	Elastic.Latinisms	Latin terms and abbreviations are a common source of confusion. Use 'for example' instead of 'e.g'.
packages/axonius/data_stream/identity/fields/fields.yml	1311	Elastic.Latinisms	Latin terms and abbreviations are a common source of confusion. Use 'for example' instead of 'e.g'.
packages/axonius/data_stream/identity/fields/fields.yml	1350	Elastic.Latinisms	Latin terms and abbreviations are a common source of confusion. Use 'for example' instead of 'e.g'.
packages/axonius/data_stream/network/fields/fields.yml	146	Elastic.Latinisms	Latin terms and abbreviations are a common source of confusion. Use 'for example' instead of 'e.g'.
packages/axonius/data_stream/network/fields/fields.yml	323	Elastic.Latinisms	Latin terms and abbreviations are a common source of confusion. Use 'for example' instead of 'e.g'.
packages/axonius/data_stream/network/fields/fields.yml	326	Elastic.Latinisms	Latin terms and abbreviations are a common source of confusion. Use 'for example' instead of 'e.g'.
packages/axonius/manifest.yml	114	Elastic.DontUse	Don't use 'Please'.

💡 Suggestions (7): Optional style improvements. Apply when helpful.

File	Line	Rule	Message
packages/axonius/changelog.yml	1	Elastic.Versions	Use 'later versions' instead of 'newer versions' when referring to versions.
packages/axonius/data_stream/compute/fields/fields.yml	788	Elastic.Repetition	"on" is repeated.
packages/axonius/data_stream/compute/fields/fields.yml	1483	Elastic.WordChoice	Consider using 'can, might' instead of 'may', unless the term is in the UI.
packages/axonius/data_stream/identity/fields/fields.yml	16	Elastic.WordChoice	Consider using 'deactivated, deselected, hidden, turned off, unavailable' instead of 'disabled', unless the term is in the UI.
packages/axonius/data_stream/identity/fields/fields.yml	1410	Elastic.WordChoice	Consider using 'can, might' instead of 'may', unless the term is in the UI.
packages/axonius/data_stream/network/fields/fields.yml	1283	Elastic.WordChoice	Consider using 'can, might' instead of 'may', unless the term is in the UI.
packages/axonius/data_stream/ticket/fields/fields.yml	129	Elastic.WordChoice	Consider using 'can, might' instead of 'may', unless the term is in the UI.

---

The Vale linter checks documentation changes against the Elastic Docs style guide. To use Vale locally or report issues, refer to Elastic style guide for Vale.

[elastic-vault-github-plugin-prod]

🚀 Benchmarks report

To see the full report comment with /test benchmark fullreport

[kcreddy]

@muskan-agarwal26 can you confirm this is the only commit 52777a0 that is newly added code in this PR (that wasn't reviewed yet)?

Maybe we create another PR just for this commit 52777a0 changes alone into existing feature/ branch first, and then revisit this PR.
@efd6 WDYT?

If we are going with this PR itself (no new PR for 52777a0), I think we should update the changelog to properly describe what's new.

[kcreddy]

The description here doesn't match with this PR.

[kcreddy]

I think current PR should be linked to description: Initial release

[kcreddy]

There are many inconsistencies in this changelog

• 7 data streams are completely missing
• Initial release not linked to the correct PR.

Could also just go with:

- version: 0.1.0
  changes:
    - description: Initial release with adapter, user, gateway, exposure, alert_finding, incident, storage, ticket, network, identity, compute, and application data streams.
      type: enhancement
      link: https://github.com/elastic/integrations/pull/19286

@efd6 any suggestion here?

[kcreddy]

@muskan-agarwal26,

A PR into elastic:main from feature/** branch (previous approach) should be enough for the new integrations - because there shouldn't be any merge conflicts (no integration related files in elastic:main yet). Did you already try this and faced any difficulties?

[elasticmachine]

💚 Build Succeeded

• Buildkite Build
• Commit: 9a836a6

History

• 💚 Build #43756 succeeded bc41e23
• 💔 Build #43753 failed 7cf8611

[efd6]

What is the feature branch that this was obtained from?

[muskan-agarwal26]

Closing as raised another(#19335) to merge into feature/axonius-0.1.0, as discussed with @kcreddy .