[axonius] Initial release of Axonius by muskan-agarwal26 · Pull Request #19376 · elastic/integrations

muskan-agarwal26 · 2026-06-04T10:28:56Z

Proposed commit message

This integration collects data from 11 data streams in the Axonius platform, including adapter, user, gateway, alert_finding, and asset-related data streams such as compute, exposure, incident, application, network, identity, ticket, and storage. Axonius fields are mapped to their corresponding ECS fields where possible.

Test samples were derived from live data samples, which were subsequently
sanitized.

API documentation: https://docs.axonius.com/docs/axonius-rest-api

All datastreams PRs are already merged.

Checklist

I have reviewed tips for building integrations and this pull request is aligned with them.
I have verified that all data streams collect metrics or logs.
I have added an entry to my package's changelog.yml file.
I have verified that Kibana version constraints are current according to guidelines.
I have verified that any added dashboard complies with Kibana's Dashboard good practices

Related issues

Relates [New Integration] Axonius #15034

This introduces a new Axonius integration for cybersecurity asset management, enabling collection of adapter health and performance data through the Axonius API. The integration provides visibility into adapter status, connection health, and configuration details to help teams maintain reliable data ingestion and identify problematic integrations. Test samples were derived from live data samples, which were subsequently sanitized.

The initial release includes user data stream and associated dashboard. Axonius fields are mapped to their corresponding ECS fields where possible. Test samples were derived from live data samples, which were subsequently sanitized.

The release includes gateway data stream and associated dashboard. Axonius fields are mapped to their corresponding ECS fields where possible. Test samples were derived from live data samples, which were subsequently sanitized.

axonius: add exposure data stream with vulnerability and asset data This new data stream collects vulnerability instances, vulnerabilities, and vulnerability repository data from the Axonius platform via the /api/v2/assets/ endpoint. Axonius fields are mapped to their corresponding ECS fields where possible. Test samples were derived from live data samples, which were subsequently sanitized. API documentation: https://docs.axonius.com/docs/axonius-rest-api --------- Co-authored-by: muskan-crest <muskan.agarwal@crestdata.ai>

…am (#16603) This new data stream collects alert findings and incidents data from the Axonius platform via the /api/v2/assets/ endpoint. Axonius fields are mapped to their corresponding ECS fields where possible. Test samples were derived from live data samples, which were subsequently sanitized. API documentation: https://docs.axonius.com/docs/axonius-rest-api

The release includes storage data stream and associated dashboard. Axonius fields are mapped to their corresponding ECS fields where possible. Test samples were derived from live data samples, which were subsequently sanitized.

The release includes ticket data stream and associated dashboard. Axonius fields are mapped to their corresponding ECS fields where possible. Test samples were derived from live data samples, which were subsequently sanitized. --------- Co-authored-by: muskan-crest <muskan.agarwal@crestdata.ai>

The release includes network data stream and associated dashboard. Axonius fields are mapped to their corresponding ECS fields where possible. Test samples were derived from live data samples, which were subsequently sanitized.

The release includes identity data stream and associated dashboard. Axonius fields are mapped to their corresponding ECS fields where possible. Test samples were derived from live data samples, which were subsequently sanitized. --------- Co-authored-by: muskan-crest <muskan.agarwal@crestdata.ai>

The release includes compute data stream and associated dashboard. Axonius fields are mapped to their corresponding ECS fields where possible. Test samples were derived from live data samples, which were subsequently sanitized. --------- Co-authored-by: muskan-crest <muskan.agarwal@crestdata.ai>

) The release includes application data stream and associated dashboard. Axonius fields are mapped to their corresponding ECS fields where possible. Test samples were derived from live data samples, which were subsequently sanitized. --------- Co-authored-by: muskan-crest <muskan.agarwal@crestdata.ai>

1. update cel code and manifest to use asset_type_list var 2. remove event.data.* and map fields on root level. 3. remove drop event from pipeline 4. update transform frequency to 90d for assets 5. ILM retention to 30d for assets 6. Add visual level filter in dashboard 7. Add remove inside on_failure in convert processor 8. Change tenant_number field type to long and description/summary field type to text 9. Add fingerprint description and code comments in transform, as added in network datastream 10. Add note in overview of dashboard for assets 11. Update the if condition in all pipeline processors to be in the format: ctx.axonius?.asset_type == pattern.

github-actions · 2026-06-04T10:30:27Z

Elastic Docs Style Checker (Vale)

Summary: 21 warnings, 7 suggestions found

⚠️ Warnings (21): Fix when the suggestion improves clarity or correctness.

File	Line	Rule	Message
packages/axonius/_dev/build/docs/README.md	5	Elastic.EndPuntuaction	Don't end headings with punctuation.
packages/axonius/_dev/build/docs/README.md	128	Elastic.MenuArrowsBold	Use '→' to separate menu items, not '' or '='. Example: Select Manage index → Add lifecycle policy.
packages/axonius/_dev/build/docs/README.md	128	Elastic.MenuArrows	Use '→' to separate menu items, not '' or '='. Example: Select Manage index → Add lifecycle policy.
packages/axonius/_dev/build/docs/README.md	165	Elastic.Latinisms	Latin terms and abbreviations are a common source of confusion. Use 'and so on' instead of 'etc'.
packages/axonius/_dev/build/docs/README.md	183	Elastic.DirectionalLanguage	Don't use directional language. Use 'the following element' instead of 'the table below'.
packages/axonius/data_stream/identity/fields/fields.yml	78	Elastic.Latinisms	Latin terms and abbreviations are a common source of confusion. Use 'for example' instead of 'e.g'.
packages/axonius/data_stream/identity/fields/fields.yml	183	Elastic.Latinisms	Latin terms and abbreviations are a common source of confusion. Use 'for example' instead of 'e.g'.
packages/axonius/data_stream/identity/fields/fields.yml	324	Elastic.Latinisms	Latin terms and abbreviations are a common source of confusion. Use 'for example' instead of 'e.g'.
packages/axonius/data_stream/identity/fields/fields.yml	447	Elastic.Accessibility	Don't use language such as 'non-verbal' that defines people by their disability.
packages/axonius/data_stream/identity/fields/fields.yml	660	Elastic.Latinisms	Latin terms and abbreviations are a common source of confusion. Use 'for example' instead of 'e.g'.
packages/axonius/data_stream/identity/fields/fields.yml	753	Elastic.Latinisms	Latin terms and abbreviations are a common source of confusion. Use 'for example' instead of 'e.g'.
packages/axonius/data_stream/identity/fields/fields.yml	807	Elastic.Latinisms	Latin terms and abbreviations are a common source of confusion. Use 'for example' instead of 'e.g'.
packages/axonius/data_stream/identity/fields/fields.yml	849	Elastic.Latinisms	Latin terms and abbreviations are a common source of confusion. Use 'for example' instead of 'e.g'.
packages/axonius/data_stream/identity/fields/fields.yml	1245	Elastic.Latinisms	Latin terms and abbreviations are a common source of confusion. Use 'for example' instead of 'e.g'.
packages/axonius/data_stream/identity/fields/fields.yml	1275	Elastic.Latinisms	Latin terms and abbreviations are a common source of confusion. Use 'for example' instead of 'e.g'.
packages/axonius/data_stream/identity/fields/fields.yml	1311	Elastic.Latinisms	Latin terms and abbreviations are a common source of confusion. Use 'for example' instead of 'e.g'.
packages/axonius/data_stream/identity/fields/fields.yml	1350	Elastic.Latinisms	Latin terms and abbreviations are a common source of confusion. Use 'for example' instead of 'e.g'.
packages/axonius/data_stream/network/fields/fields.yml	146	Elastic.Latinisms	Latin terms and abbreviations are a common source of confusion. Use 'for example' instead of 'e.g'.
packages/axonius/data_stream/network/fields/fields.yml	323	Elastic.Latinisms	Latin terms and abbreviations are a common source of confusion. Use 'for example' instead of 'e.g'.
packages/axonius/data_stream/network/fields/fields.yml	326	Elastic.Latinisms	Latin terms and abbreviations are a common source of confusion. Use 'for example' instead of 'e.g'.
packages/axonius/manifest.yml	114	Elastic.DontUse	Don't use 'Please'.

💡 Suggestions (7): Optional style improvements. Apply when helpful.

File	Line	Rule	Message
packages/axonius/changelog.yml	1	Elastic.Versions	Use 'later versions' instead of 'newer versions' when referring to versions.
packages/axonius/data_stream/compute/fields/fields.yml	788	Elastic.Repetition	"on" is repeated.
packages/axonius/data_stream/compute/fields/fields.yml	1483	Elastic.WordChoice	Consider using 'can, might' instead of 'may', unless the term is in the UI.
packages/axonius/data_stream/identity/fields/fields.yml	16	Elastic.WordChoice	Consider using 'deactivated, deselected, hidden, turned off, unavailable' instead of 'disabled', unless the term is in the UI.
packages/axonius/data_stream/identity/fields/fields.yml	1410	Elastic.WordChoice	Consider using 'can, might' instead of 'may', unless the term is in the UI.
packages/axonius/data_stream/network/fields/fields.yml	1283	Elastic.WordChoice	Consider using 'can, might' instead of 'may', unless the term is in the UI.
packages/axonius/data_stream/ticket/fields/fields.yml	129	Elastic.WordChoice	Consider using 'can, might' instead of 'may', unless the term is in the UI.

The Vale linter checks documentation changes against the Elastic Docs style guide. To use Vale locally or report issues, refer to Elastic style guide for Vale.

elastic-vault-github-plugin-prod · 2026-06-04T10:33:39Z

Changelog link mismatch — expected https://github.com/elastic/integrations/pull/19376 in the following file(s):

packages/axonius/changelog.yml

Tip

Add the changelog-link-check:skip label to skip this check.

View Buildkite build
@muskan-agarwal26

elasticmachine · 2026-06-04T10:33:42Z

💔 Build Failed

Buildkite Build
Commit: e757343

Failed CI Steps

📜 Check changelog PR links

History

elastic-vault-github-plugin-prod · 2026-06-04T10:58:48Z

🚀 Benchmarks report

To see the full report comment with /test benchmark fullreport

kcreddy

LGTM

The CI failure is due to Check changelog PR links validation. For a new integration, I think it is okay to skip because most of the work is done in other PRs and feature/axonius-0.1.0 is branch protected.

@efd6 WDYT?

infra-vault-gh-plugin-prod · 2026-06-04T12:05:28Z

Pinging @elastic/security-service-integrations (Team:Security-Service Integrations)

efd6 · 2026-06-04T22:39:20Z

@kcreddy Agree; in this context where there is no change in the PR and all the contributions are reviewed and modified in child PRs into the feature branch, the check is incorrect and should be ignored.

@mrodm Can you bypass/disable that check for this kind of PR.

kcreddy · 2026-06-05T03:41:41Z

@kcreddy Agree; in this context where there is no change in the PR and all the contributions are reviewed and modified in child PRs into the feature branch, the check is incorrect and should be ignored.

@mrodm Can you bypass/disable that check for this kind of PR.

Thanks, adding the changelog-link-check:skip label disabled the validation. I will now merge it.

muskan-agarwal26 and others added 13 commits December 31, 2025 17:57

[axonius][user] Add Axonius User datastream (#16142)

4fee8da

The initial release includes user data stream and associated dashboard. Axonius fields are mapped to their corresponding ECS fields where possible. Test samples were derived from live data samples, which were subsequently sanitized.

[axonius][gateway] Add Axonius Gateway datastream (#16169)

8d7e0c7

The release includes gateway data stream and associated dashboard. Axonius fields are mapped to their corresponding ECS fields where possible. Test samples were derived from live data samples, which were subsequently sanitized.

[axonius][storage] Add Axonius Storage datastream (#16605)

66522b9

The release includes storage data stream and associated dashboard. Axonius fields are mapped to their corresponding ECS fields where possible. Test samples were derived from live data samples, which were subsequently sanitized.

[axonius][network] Add Axonius Network datastream (#16657)

01bcd14

The release includes network data stream and associated dashboard. Axonius fields are mapped to their corresponding ECS fields where possible. Test samples were derived from live data samples, which were subsequently sanitized.

[Axonius][identity] Update changelog description (#18839)

ca3939a

muskan-agarwal26 requested a review from a team as a code owner June 4, 2026 10:28

kcreddy added changelog-link-check:skip New Integration Issue or pull request for creating a new integration package. Crest Contributions from Crest developement team. labels Jun 4, 2026

kcreddy approved these changes Jun 4, 2026

View reviewed changes

andrewkroh added the documentation Improvements or additions to documentation. Applied to PRs that modify *.md files. label Jun 4, 2026

kcreddy added the Team:Security-Service Integrations Security Service Integrations team [elastic/security-service-integrations] label Jun 4, 2026

kcreddy merged commit 570d751 into main Jun 5, 2026
12 checks passed

kcreddy deleted the feature/axonius-0.1.0 branch June 5, 2026 04:01

andrewkroh added the dashboard Relates to a Kibana dashboard bug, enhancement, or modification. label Jun 5, 2026

andrewkroh added the Integration:axonius Axonius label Jun 5, 2026

github-actions Bot mentioned this pull request Jun 5, 2026

[breaking-change] Undocumented breaking changes detected (2026-06-05) #19402

Open

1 of 3 tasks

Navigation Menu

Repository navigation

[axonius] Initial release of Axonius - #19376

[axonius] Initial release of Axonius#19376
kcreddy merged 13 commits into
mainfrom
feature/axonius-0.1.0

muskan-agarwal26 commented Jun 4, 2026 •

edited

Loading

Uh oh!

github-actions Bot commented Jun 4, 2026

Uh oh!

elastic-vault-github-plugin-prod Bot commented Jun 4, 2026

Uh oh!

elasticmachine commented Jun 4, 2026 •

edited

Loading

Uh oh!

elastic-vault-github-plugin-prod Bot commented Jun 4, 2026

Uh oh!

kcreddy left a comment

Uh oh!

infra-vault-gh-plugin-prod Bot commented Jun 4, 2026

Uh oh!

efd6 commented Jun 4, 2026 •

edited

Loading

Uh oh!

kcreddy commented Jun 5, 2026

Uh oh!

Uh oh!

Reviewers

Uh oh!

Assignees

Labels

Projects

Milestone

Development

Uh oh!

5 participants

Conversation

muskan-agarwal26 commented Jun 4, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Proposed commit message

Checklist

Related issues

Uh oh!

github-actions Bot commented Jun 4, 2026

Elastic Docs Style Checker (Vale)

Uh oh!

elastic-vault-github-plugin-prod Bot commented Jun 4, 2026

Uh oh!

elasticmachine commented Jun 4, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

💔 Build Failed

Failed CI Steps

History

Uh oh!

elastic-vault-github-plugin-prod Bot commented Jun 4, 2026

🚀 Benchmarks report

Uh oh!

kcreddy left a comment

Choose a reason for hiding this comment

Uh oh!

infra-vault-gh-plugin-prod Bot commented Jun 4, 2026

Uh oh!

efd6 commented Jun 4, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

kcreddy commented Jun 5, 2026

Uh oh!

Uh oh!

Reviewers

Uh oh!

Assignees

Labels

Projects

Milestone

Development

Uh oh!

5 participants

muskan-agarwal26 commented Jun 4, 2026 •

edited

Loading

elasticmachine commented Jun 4, 2026 •

edited

Loading

efd6 commented Jun 4, 2026 •

edited

Loading