Skip to content

Commit e9add78

Browse files
[cyera][issue] Add Cyera Issue datastream (#15107)
The PR includes issue data stream and associated dashboard. Cyera fields are mapped to their corresponding ECS fields where possible. Test samples were derived from live data samples, which were subsequently sanitized.
1 parent 9087a3a commit e9add78

31 files changed

+4956
-201
lines changed

packages/cyera/_dev/build/docs/README.md

Lines changed: 14 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -8,27 +8,27 @@ The Cyera integration for Elastic allows you to collect logs and visualize the d
88

99
### Compatibility
1010

11-
The Cyera integration supports the following versions of Cyera APIs.
11+
This integration is compatible with different versions of Cyera APIs for respective data streams as below:
1212

1313
| Data streams | Version |
1414
|----------------|---------|
1515
| Classification | v1 |
1616
| Issue | v3 |
17-
| Datastore | v2 |
18-
| Event | v1 |
1917

2018
### How it works
2119

22-
This integration periodically queries the Cyera API to retrieve classifications.
20+
This integration periodically queries the Cyera API to retrieve classifications and issues.
2321

2422
## What data does this integration collect?
2523

2624
This integration collects log messages of the following types:
2725

2826
- `Classification`: Collects classifications that have been identified by the Cyera system.
2927

28+
- `Issue`: Collects issues that have been identified by the Cyera system.
29+
3030
### Supported use cases
31-
Integrating Cyera Classification data stream with Elastic SIEM provides visibility into sensitive data classification across cloud and SaaS environments. By correlating Cyera’s classification intelligence with Elastic analytics, security teams can strengthen data security posture and simplify compliance. Dashboards in Kibana present breakdowns by sensitivity, category, and trends over time, enabling faster investigations and improved accountability.
31+
Integrating Cyera Classification and Issues data streams with Elastic SIEM provides visibility into both sensitive data classification and the risks associated with that data across cloud and SaaS environments. By correlating Cyera’s classification intelligence with issue context in Elastic analytics, security teams can strengthen data security posture, accelerate incident response, and simplify compliance. Dashboards in Kibana present breakdowns by sensitivity, category, severity, status, risk status, and trends over time, enabling faster investigations, better prioritization, and improved accountability.
3232

3333
## What do I need to use this integration?
3434

@@ -106,6 +106,14 @@ For more information on architectures that can be used for scaling this integrat
106106

107107
{{event "classification"}}
108108

109+
### Issue
110+
111+
{{fields "issue"}}
112+
113+
#### Example event
114+
115+
{{event "issue"}}
116+
109117
### Inputs used
110118

111119
These inputs can be used in this integration:
@@ -114,4 +122,4 @@ These inputs can be used in this integration:
114122

115123
#### ILM Policy
116124

117-
To facilitate classification data, source data stream-backed indices `.ds-logs-cyera.<data_stream_name>-*` are allowed to contain duplicates from each polling interval. ILM policy `logs-cyera.<data_stream_name>-default_policy` is added to these source indices, so it doesn't lead to unbounded growth. This means that in these source indices data will be deleted after `30 days` from ingested date.
125+
To facilitate classification and issues data, source data stream-backed indices `.ds-logs-cyera.<data_stream_name>-*` are allowed to contain duplicates from each polling interval. ILM policy `logs-cyera.<data_stream_name>-default_policy` is added to these source indices, so it doesn't lead to unbounded growth. This means that in these source indices data will be deleted after `30 days` from ingested date.

0 commit comments

Comments
 (0)