crowdstrike: add identity protection timeline data stream

[navnit-elastic]

Proposed commit message

crowdstrike: add identity protection timeline data stream

- Collect Falcon Identity Protection timeline over GraphQL, with ingest pipeline,
  field mappings, tests, and benchmarks.
- Update existing CrowdStrike dashboards to add a link
  to the new Identity Protection timeline dashboard.

Pipeline and related test samples come from a live CrowdStrike tenant.

Checklist

• I have reviewed tips for building integrations and this pull request is aligned with them.
• I have verified that all data streams collect metrics or logs.
• I have added an entry to my package's changelog.yml file.
• I have verified that Kibana version constraints are current according to guidelines.
• I have verified that any added dashboard complies with Kibana's Dashboard good practices

Author's Checklist

• [ ]

How to test this PR locally

• Clone integrations repo.
• Install elastic package locally.
• Start elastic stack using elastic-package.
• Move to integrations/packages/crowdstrike directory.
• Run the following command to run tests.

elastic-package test

Related issues

• Closes [CrowdStrike]: Add support for Falcon Identity Protection module #17846

Screenshots

[github-actions]

Vale Linting Results

Summary: 6 warnings, 1 suggestion found

⚠️ Warnings (6)

File	Line	Rule	Message
packages/crowdstrike/docs/README.md	3944	Elastic.Latinisms	Latin terms and abbreviations are a common source of confusion. Use 'and so on' instead of 'etc'.
packages/crowdstrike/docs/README.md	3944	Elastic.DirectionalLanguage	Don't use directional language. Use 'earlier on this page' instead of 'noted above'.
packages/crowdstrike/docs/README.md	3945	Elastic.DirectionalLanguage	Don't use directional language. Use 'earlier on this page' instead of 'noted above'.
packages/crowdstrike/docs/README.md	3946	Elastic.QuotesPunctuation	Place punctuation inside closing quotation marks.
packages/crowdstrike/docs/README.md	3947	Elastic.Latinisms	Latin terms and abbreviations are a common source of confusion. Use 'for example' instead of 'e.g'.
packages/crowdstrike/docs/README.md	3948	Elastic.Latinisms	Latin terms and abbreviations are a common source of confusion. Use 'for example' instead of 'e.g'.

💡 Suggestions (1)

File	Line	Rule	Message
packages/crowdstrike/docs/README.md	3911	Elastic.WordChoice	Consider using 'can, might' instead of 'may', unless the term is in the UI.

---

The Vale linter checks documentation changes against the Elastic Docs style guide.

To use Vale locally or report issues, refer to Elastic style guide for Vale.

[elastic-vault-github-plugin-prod]

🚀 Benchmarks report

To see the full report comment with /test benchmark fullreport

[github-actions]

TL;DR

Buildkite failed before tests/build steps because the repository post-checkout hook could not complete an automatic merge with origin/main. The branch needs a rebase/merge conflict resolution (mainly in packages/crowdstrike) before CI can proceed.

Remediation

• Rebase navnit-elastic:17846-crowdstrike-idp-timeline onto latest main (or merge main) and resolve the reported conflicts.
• Regenerate/update the affected CrowdStrike assets consistently (dashboards/searches/changelog), commit the resolutions, and rerun CI.

Investigation details

Root Cause

The failing job (:pipeline::arrow_up: Upload Pipeline: .buildkite/pipeline.yml) exits in the repository post-checkout hook after an automatic merge attempt fails with content conflicts.

Conflicts reported in the log include:

• packages/crowdstrike/changelog.yml
• multiple files under packages/crowdstrike/kibana/dashboard/*.json
• multiple files under packages/crowdstrike/kibana/search/*.json

Because this happens during checkout/hook execution, pipeline upload aborts and downstream CI steps do not run.

Evidence

• Build: https://buildkite.com/elastic/integrations/builds/43235
• Job/step: :pipeline::arrow_up: Upload Pipeline: .buildkite/pipeline.yml
• Key log excerpt:
  • CONFLICT (content): Merge conflict in packages/crowdstrike/changelog.yml
  • CONFLICT (content): Merge conflict in packages/crowdstrike/kibana/dashboard/...
  • CONFLICT (content): Merge conflict in packages/crowdstrike/kibana/search/...
  • Automatic merge failed; fix conflicts and then commit the result.
  • 🚨 Error: running "repository post-checkout" shell hook: ... exited with status 1

Verification

• Not run locally; diagnosis is based on the Buildkite job log at /tmp/gh-aw/buildkite-logs/integrations-pipelinearrow_up-upload-pipeline-buildkitepipelineyml.txt.

Follow-up

After resolving conflicts, re-run Buildkite. If it still fails, the next actionable signal should come from the first actual build/test step (instead of checkout).

Note

🔒 Integrity filter blocked 2 items

The following items were blocked because they don't meet the GitHub integrity level.

• crowdstrike: add identity protection timeline data stream #19061 pull_request_read: has lower integrity than agent requires. The agent cannot read data with integrity below "approved".
• #19061 pull_request_read: has lower integrity than agent requires. The agent cannot read data with integrity below "approved".

To allow these resources, lower min-integrity in your GitHub frontmatter:

tools:
  github:
    min-integrity: approved  # merged | approved | unapproved | none

---

What is this? | From workflow: PR Buildkite Detective

Give us feedback! React with 🚀 if perfect, 👍 if helpful, 👎 if not.

[infra-vault-gh-plugin-prod]

Pinging @elastic/security-service-integrations (Team:Security-Service Integrations)

[elasticmachine]

💚 Build Succeeded

• Buildkite Build
• Commit: 06166c7

History

• 💔 Build #43491 failed 708207a
• 💚 Build #43321 succeeded 002f2ce
• 💚 Build #43289 succeeded 84724b2
• 💔 Build #43235 failed a8c52b4
• 💚 Build #43060 succeeded 015d928

cc @navnit-elastic

[elastic-vault-github-plugin-prod]

Package crowdstrike - 3.19.0 containing this change is available at https://epr.elastic.co/package/crowdstrike/3.19.0/