[cyera][issue] Add Cyera Issue datastream

[muskan-agarwal26]

Proposed commit message

The initial release includes issue data stream and associated dashboard.

Cyera fields are mapped to their corresponding ECS fields where possible.

Test samples were derived from live data samples, which were subsequently
sanitized.

Checklist

• I have reviewed tips for building integrations and this pull request is aligned with them.
• I have verified that all data streams collect metrics or logs.
• I have added an entry to my package's changelog.yml file.
• I have verified that Kibana version constraints are current according to guidelines.
• I have verified that any added dashboard complies with Kibana's Dashboard good practices

How to test this PR locally

To test the cyera package:

• Clone integrations repo.
• Install elastic package locally.
• Start elastic stack using elastic-package.
• Move to integrations/packages/cyera directory.
• Run the following command to run tests.

elastic-package test

2025/09/01 14:40:32 INFO New version is available - v0.114.0. Download from: https://github.com/elastic/elastic-package/releases/tag/v0.114.0 Run asset tests for the package 2025/09/01 14:40:32 INFO License text found in "/root/GITHUB/integrations/LICENSE.txt" will be included in package --- Test results for package: cyera - START --- ╭─────────┬─────────────┬───────────┬────────────────────────────────────────────────────────────────┬────────┬──────────────╮ │ PACKAGE │ DATA STREAM │ TEST TYPE │ TEST NAME │ RESULT │ TIME ELAPSED │ ├─────────┼─────────────┼───────────┼────────────────────────────────────────────────────────────────┼────────┼──────────────┤ │ cyera │ │ asset │ dashboard cyera-db5aefa7-05b8-4a10-9cb6-55a71c617e29 is loaded │ PASS │ 2.784µs │ │ cyera │ │ asset │ search cyera-e1ffb4d3-c43c-4047-bb92-b2a2c46d8b1d is loaded │ PASS │ 615ns │ │ cyera │ issue │ asset │ index_template logs-cyera.issue is loaded │ PASS │ 199ns │ │ cyera │ issue │ asset │ ingest_pipeline logs-cyera.issue-0.1.0 is loaded │ PASS │ 253ns │ ╰─────────┴─────────────┴───────────┴────────────────────────────────────────────────────────────────┴────────┴──────────────╯ --- Test results for package: cyera - END --- Done Run pipeline tests for the package --- Test results for package: cyera - START --- ╭─────────┬─────────────┬───────────┬───────────────────────────────────────────┬────────┬──────────────╮ │ PACKAGE │ DATA STREAM │ TEST TYPE │ TEST NAME │ RESULT │ TIME ELAPSED │ ├─────────┼─────────────┼───────────┼───────────────────────────────────────────┼────────┼──────────────┤ │ cyera │ issue │ pipeline │ (ingest pipeline warnings test-issue.log) │ PASS │ 1.529003403s │ │ cyera │ issue │ pipeline │ test-issue.log │ PASS │ 394.608895ms │ ╰─────────┴─────────────┴───────────┴───────────────────────────────────────────┴────────┴──────────────╯ --- Test results for package: cyera - END --- Done Run policy tests for the package --- Test results for package: cyera - START --- No test results --- Test results for package: cyera - END --- Done Run static tests for the package --- Test results for package: cyera - START --- ╭─────────┬─────────────┬───────────┬──────────────────────────┬────────┬──────────────╮ │ PACKAGE │ DATA STREAM │ TEST TYPE │ TEST NAME │ RESULT │ TIME ELAPSED │ ├─────────┼─────────────┼───────────┼──────────────────────────┼────────┼──────────────┤ │ cyera │ issue │ static │ Verify sample_event.json │ PASS │ 205.951205ms │ ╰─────────┴─────────────┴───────────┴──────────────────────────┴────────┴──────────────╯ --- Test results for package: cyera - END --- Done Run system tests for the package 2025/09/01 14:40:44 INFO License text found in "/root/GITHUB/integrations/LICENSE.txt" will be included in package 2025/09/01 14:43:15 INFO Write container logs to file: /root/GITHUB/integrations/build/container-logs/cyera_issue-1756717995651929143.log 2025/09/01 14:43:20 INFO Write container logs to file: /root/GITHUB/integrations/build/container-logs/elastic-agent-1756718000029691077.log --- Test results for package: cyera - START --- ╭─────────┬─────────────┬───────────┬───────────┬────────┬─────────────────╮ │ PACKAGE │ DATA STREAM │ TEST TYPE │ TEST NAME │ RESULT │ TIME ELAPSED │ ├─────────┼─────────────┼───────────┼───────────┼────────┼─────────────────┤ │ cyera │ issue │ system │ default │ PASS │ 2m26.962188265s │ ╰─────────┴─────────────┴───────────┴───────────┴────────┴─────────────────╯ --- Test results for package: cyera - END --- Done 

Related issues

• Relates [New Integration] Cyera #14728
• Relates [Cyera] Cannot execute ILM policy delete step kibana#235998

Screenshots

[kcreddy]

/test

[elastic-vault-github-plugin-prod]

🚀 Benchmarks report

To see the full report comment with /test benchmark fullreport

[kcreddy]

/test

[elasticmachine]

Pinging @elastic/security-service-integrations (Team:Security-Service Integrations)

[efd6]

/test

[efd6]

/test

[kcreddy]

/test

[elasticmachine]

💚 Build Succeeded

• Buildkite Build
• Commit: c5b54fe

History

• 💚 Build #31766 succeeded 6590bbd
• 💚 Build #31051 succeeded af5fc5d
• 💚 Build #30836 succeeded b784541
• 💚 Build #30778 succeeded b85a5a2

[elastic-sonarqube]

Quality Gate passed

Issues
0 New issues
0 Fixed issues
0 Accepted issues

Measures
0 Security Hotspots
90.3% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube

[kcreddy]

@efd6, I'm merging this PR as it got your approval and its requested by Crest.

[elastic-vault-github-plugin-prod]

Package cyera - 0.2.0 containing this change is available at https://epr.elastic.co/package/cyera/0.2.0/