[Workday][Sign-on] Add Sign-on data stream - #20039
Conversation
Co-authored-by: Cursor <cursoragent@cursor.com>
Elastic Docs Style Checker (Vale)Summary: 2 suggestions found 💡 Suggestions (2): Optional style improvements. Apply when helpful.
The Vale linter checks documentation changes against the Elastic Docs style guide. To use Vale locally or report issues, refer to Elastic style guide for Vale. |
Co-authored-by: Cursor <cursoragent@cursor.com>
🚀 Benchmarks reportTo see the full report comment with |
andrewkroh
added
Crest
Co-authored-by: Cursor <cursoragent@cursor.com>
TL;DR
Remediation
Investigation detailsRoot CauseThe PR moves Activity-specific required variables into the Activity data stream manifest:
That layout matched the old manifest, but after this PR the required Activity variables must be supplied through Evidence
Verification
What is this? | From workflow: PR Buildkite Detective Give us feedback! React with 🚀 if perfect, 👍 if helpful, 👎 if not. |
andrewkroh
added
the
Team:Security-Service Integrations
|
Pinging @elastic/security-service-integrations (Team:Security-Service Integrations) |
![vera-review-bot[bot]](https://cdn.statically.io/img/avatars.githubusercontent.com/in/3297022?s=60&v=4){kind=small}
| } | ||
| }, | ||
| "delete": { | ||
| "min_age": "30d", |
There was a problem hiding this comment.
Severity: 🟡 Medium confidence: medium path: packages/workday/data_stream/sign_on/elasticsearch/ilm/default_policy.json:16
The new sign_on data stream ships a custom ILM policy that deletes data after 30 days, silently discarding authentication/audit telemetry; drop the delete phase (or the custom policy) and let the stack-managed logs lifecycle govern retention.
Details
The sign_on data stream introduces a package-shipped ILM policy with a delete phase at min_age: 30d. This hard-deletes sign-on records after 30 days, which is short for security/authentication audit data that teams typically retain for investigations and compliance. The pre-existing activity data stream ships no custom ILM policy and relies on the stack-managed logs lifecycle, so this also makes retention inconsistent within the same package and overrides the retention strategy the user would otherwise control.
Recommendation:
Prefer not shipping a custom lifecycle and letting the stack-managed logs policy handle retention (remove the ilm_policy line in manifest.yml and the ilm/default_policy.json file). If a custom rollover is genuinely required, at minimum drop the auto-delete so audit data is not silently removed:
{
"policy": {
"phases": {
"hot": {
"actions": {
"rollover": {
"max_age": "2d",
"max_size": "50gb"
},
"set_priority": {
"priority": 100
}
}
}
}
}
}🤖 AI-Generated Review | Vera Review Bot | 📚 Knowledge base: integration-skills
⚠️ Automated review — verify suggestions before applying.
| title: Sign-on logs | ||
| description: Collect Sign-on logs from Workday. | ||
| template_path: cel.yml.hbs | ||
| vars: |
There was a problem hiding this comment.
Severity: 🔵 Low confidence: medium path: packages/workday/data_stream/sign_on/manifest.yml:9
The sign_on cel.yml.hbs references proxy_url and ssl but the sign_on manifest defines neither var, so those template branches are dead and users cannot configure a proxy or custom CA for the HTTPS Workday endpoint; add the vars (as the activity stream already does).
Details
The shared sign_on template (agent/stream/cel.yml.hbs) contains {{#if proxy_url}}resource.proxy_url: {{proxy_url}}{{/if}} and {{#if ssl}}resource.ssl: {{ssl}}{{/if}}, but the sign_on manifest's stream vars list does not declare proxy_url or ssl. As a result those branches never render and operators have no way to route the Workday Custom Report (RaaS) HTTPS request through a proxy or trust a custom/internal CA — capabilities the activity policy template does expose. This is a configuration-completeness gap for enterprise Workday deployments.
Recommendation:
Declare the proxy_url and ssl vars in the sign_on stream, mirroring the activity input:
- name: proxy_url
type: text
title: Proxy URL
description: proxy configuration in the form of https://<user>:<password>@<server name/ip>:<port>.
multi: false
required: false
show_user: false
- name: ssl
type: yaml
title: SSL Configuration
description: SSL configuration options. See [documentation](https://www.elastic.co/guide/en/beats/filebeat/current/configuration-ssl.html#ssl-common-config) for details.
multi: false
required: false
show_user: false🤖 AI-Generated Review | Vera Review Bot | 📚 Knowledge base: integration-skills
⚠️ Automated review — verify suggestions before applying.
| "authentication", | ||
| "session" | ||
| ], | ||
| "end": "2026-06-19T06:25:22.000Z", |
There was a problem hiding this comment.
@uri-weisman do you think it makes sense that this session_end timestamp is mapped to host.entity.lifecycle.last_activity?
Would you map it to the session_start field instead?
https://www.elastic.co/docs/reference/ecs/ecs-entity#field-entity-lifecycle-last-activity
There was a problem hiding this comment.
That's a good point, but we just need to verify that for activity logs, besides sign-on we populate this field.
…orkday-sign_on-0.1.1
efd6
left a comment
efd6
left a comment
There was a problem hiding this comment.
The most recent Vera review is correct.
|
✅ All changelog entries have the correct PR link. |
|
No issues across the latest commits f523150. Review summaryIssues found across earlier commits e1abf06…9478bbe (34 commits) — 1 low
Issues found across earlier commits 7d20ff6 — 1 medium
Issues found across earlier commits 94d8c84 — 1 high, 1 medium, 1 low
Issues found across earlier commits bd625d5 — 2 high, 5 medium, 2 low
🤖 AI-Generated Review | Vera Review Bot | 📚 Knowledge base: integration-skills
|
💚 Build Succeeded
History
|
|
Tick the box to add this pull request to the merge queue (same as
|
|
Package workday - 0.3.0 containing this change is available at https://epr.elastic.co/package/workday/0.3.0/ |
This PR adds the `sign_on` data stream to the Workday integration, along with its associated dashboard and visualizations. Workday fields are mapped to their corresponding ECS fields where possible. Test samples were derived from live data samples, which were subsequently sanitized.
6 participants
Proposed commit message
Checklist
changelog.ymlfile.How to test this PR locally
To test the Workday package:
Related issues
Screenshots