[arenard]

Proposed commit message

Fix the copy-pasted descriptions of the default and count ingest pipelines, remove field definitions that never appear in events (stormshield.tz, stormshield.duration, stormshield.msg, stormshield.origdst, stormshield.origdstport — the pipeline consumes tz into event.timezone, converts duration into event.duration, renames msg to message, and drops origdst/origdstport after converting them to destination.*), and correct the documentation:

• the agent syslog processor is configured for RFC5424, so the README no longer presents the Legacy format as supported;
• the compatibility section now covers SNS 4.x and 5.x, which share the same WELF key-value audit log format (SNS 5 has been generally available since February 2026).

Also documents how to collect SNS IPFIX flow records with the NetFlow integration, updates vendor documentation links to SNS v5, and uses arrows for menu paths per the documentation style guide.

Checklist

• I have reviewed tips for building integrations and this pull request is aligned with them.
• I have verified that all data streams collect metrics or logs.
• I have added an entry to my package's changelog.yml file.
• I have verified that Kibana version constraints are current according to guidelines.
• I have verified that any added dashboard complies with Kibana's Dashboard good practices (no dashboard changes)

Author's Checklist

• The five removed field definitions are absent from all pipeline test expected documents and from sample_event.json (the definitions were dead documentation)
• No pipeline behavior change: only description fields were touched in the pipelines

How to test this PR locally

cd packages/stormshield
elastic-package check
elastic-package test pipeline
elastic-package test static

All pass against stack 9.4.3.

Related issues

• Relates [stormshield] Follow-up tasks for new integration #10114

[cla-checker-service]

💚 CLA has been signed

[github-actions]

✅ Elastic Docs Style Checker (Vale)

No issues found on modified lines!

---

The Vale linter checks documentation changes against the Elastic Docs style guide. To use Vale locally or report issues, refer to Elastic style guide for Vale.

[elastic-vault-github-plugin-prod]

🚀 Benchmarks report

To see the full report comment with /test benchmark fullreport

[elastic-vault-github-plugin-prod]

✅ All changelog entries have the correct PR link.

[infra-vault-gh-plugin-prod]

💚 Build Succeeded

• Buildkite Build
• Commit: 18090cd

History

• 💚 Build #45821 succeeded 64ce75f
• 💚 Build #45744 succeeded 1024850
• 💚 Build #45742 succeeded 296568d
• 💚 Build #45735 succeeded a7be5bf
• 💚 Build #45707 succeeded 9d364d6

[infra-vault-gh-plugin-prod]

Pinging @elastic/integration-experience (Team:Integration-Experience)

[vera-review-bot]

No issues across the latest commits 18090cd.

A new commit triggers another review — at most once every 15 minutes. I skip the PR while it's approved or has merge conflicts.

🤖 AI-Generated Review | Vera Review Bot | 📚 Knowledge base: integration-skills

⚠️ Automated review — verify suggestions before applying.

[mergify]

Tick the box to add this pull request to the merge queue (same as @mergifyio queue).

• Queue this pull request

[elastic-vault-github-plugin-prod]

Package stormshield - 1.5.3 containing this change is available at https://epr.elastic.co/package/stormshield/1.5.3/