[beyondtrust_pra] Initial release of the BeyondTrust PRA

[janvi-elastic]

Proposed commit message

The initial release includes an access_session data stream and associated dashboard
and visualizations.

BeyondTrust PRA fields are mapped to their corresponding ECS fields where possible.

Test samples were derived from documentation, which were subsequently
sanitized.

Checklist

• I have reviewed tips for building integrations and this pull request is aligned with them.
• I have verified that all data streams collect metrics or logs.
• I have added an entry to my package's changelog.yml file.
• I have verified that Kibana version constraints are current according to guidelines.

How to test this PR locally

• Clone integrations repo.
• Install elastic package locally.
• Start elastic stack using elastic-package.
• Move to integrations/packages/beyondtrust_pra directory.
• Run the following command to run tests.

elastic-package test

--- Test results for package: beyondtrust_pra - START ---
╭─────────────────┬────────────────┬───────────┬──────────────────────────────────────────────────────────────────────────┬────────┬──────────────╮
│ PACKAGE         │ DATA STREAM    │ TEST TYPE │ TEST NAME                                                                │ RESULT │ TIME ELAPSED │
├─────────────────┼────────────────┼───────────┼──────────────────────────────────────────────────────────────────────────┼────────┼──────────────┤
│ beyondtrust_pra │                │ asset     │ dashboard beyondtrust_pra-7227e888-45cd-4e05-8ac3-f7d18c367bec is loaded │ PASS   │       1.38µs │
│ beyondtrust_pra │                │ asset     │ search beyondtrust_pra-6738050a-2a9a-403a-b785-9ea93f0aff61 is loaded    │ PASS   │        200ns │
│ beyondtrust_pra │ access_session │ asset     │ index_template logs-beyondtrust_pra.access_session is loaded             │ PASS   │        107ns │
│ beyondtrust_pra │ access_session │ asset     │ ingest_pipeline logs-beyondtrust_pra.access_session-0.1.0 is loaded      │ PASS   │        113ns │
╰─────────────────┴────────────────┴───────────┴──────────────────────────────────────────────────────────────────────────┴────────┴──────────────╯
--- Test results for package: beyondtrust_pra - END   ---
Done
--- Test results for package: beyondtrust_pra - START ---
╭─────────────────┬────────────────┬───────────┬───────────────────────────────────────────┬────────┬──────────────╮
│ PACKAGE         │ DATA STREAM    │ TEST TYPE │ TEST NAME                                 │ RESULT │ TIME ELAPSED │
├─────────────────┼────────────────┼───────────┼───────────────────────────────────────────┼────────┼──────────────┤
│ beyondtrust_pra │ access_session │ pipeline  │ (ingest pipeline warnings test-event.log) │ PASS   │ 295.273878ms │
│ beyondtrust_pra │ access_session │ pipeline  │ test-event.log                            │ PASS   │ 162.596393ms │
╰─────────────────┴────────────────┴───────────┴───────────────────────────────────────────┴────────┴──────────────╯
--- Test results for package: beyondtrust_pra - END   ---
Done
--- Test results for package: beyondtrust_pra - START ---
╭─────────────────┬────────────────┬───────────┬──────────────────────────┬────────┬──────────────╮
│ PACKAGE         │ DATA STREAM    │ TEST TYPE │ TEST NAME                │ RESULT │ TIME ELAPSED │
├─────────────────┼────────────────┼───────────┼──────────────────────────┼────────┼──────────────┤
│ beyondtrust_pra │ access_session │ static    │ Verify sample_event.json │ PASS   │ 120.963997ms │
╰─────────────────┴────────────────┴───────────┴──────────────────────────┴────────┴──────────────╯
--- Test results for package: beyondtrust_pra - END   ---
Done
--- Test results for package: beyondtrust_pra - START ---
╭─────────────────┬────────────────┬───────────┬───────────┬────────┬───────────────╮
│ PACKAGE         │ DATA STREAM    │ TEST TYPE │ TEST NAME │ RESULT │  TIME ELAPSED │
├─────────────────┼────────────────┼───────────┼───────────┼────────┼───────────────┤
│ beyondtrust_pra │ access_session │ system    │ common    │ PASS   │ 33.971497096s │
╰─────────────────┴────────────────┴───────────┴───────────┴────────┴───────────────╯
--- Test results for package: beyondtrust_pra - END   ---
Done

Related issues

• Closes [New Integration] BeyondTrust PRA #13267

Screenshot

[elastic-vault-github-plugin-prod]

🚀 Benchmarks report

To see the full report comment with /test benchmark fullreport

[elasticmachine]

Pinging @elastic/security-service-integrations (Team:Security-Service Integrations)

[kcreddy]

@janvi-elastic, may I know if the PR ready for a re-review?

[janvi-elastic]

@janvi-elastic, may I know if the PR ready for a re-review?

Yes, We have resolved the review comments.

[kcreddy]

Clarification on
#13403 (comment)

[elasticmachine]

💚 Build Succeeded

• Buildkite Build
• Commit: 40c4cc5

History

• 💚 Build #24688 succeeded 231ad21
• 💚 Build #24238 succeeded b5f1bed

[elastic-sonarqube]

Quality Gate passed

Issues
0 New issues
0 Fixed issues
0 Accepted issues

Measures
0 Security Hotspots
98.4% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube

[elastic-vault-github-plugin-prod]

Package beyondtrust_pra - 0.1.0 containing this change is available at https://epr.elastic.co/package/beyondtrust_pra/0.1.0/