[google_workspace] Add calendar event type as a new data stream

[navnit-elastic]

Proposed commit message

google_workspace: add support for calendar event type as a new data stream

This adds support for the Calendar audit event type as a new data stream to
enhance the overall visibility of data in the Google Workspace integration.

This changes includes updating navigation links in to the relevant dashboards.

Sanitized test case inputs were obtained from live Google Workspace instance
using the Admin SDK for Reports API[1].

[1] https://developers.google.com/workspace/admin/reports/reference/rest

Checklist

• I have reviewed tips for building integrations and this pull request is aligned with them.
• I have verified that all data streams collect metrics or logs.
• I have added an entry to my package's changelog.yml file.
• I have verified that Kibana version constraints are current according to guidelines.
• I have verified that any added dashboard complies with Kibana's Dashboard good practices

Author's Checklist

• [ ]

How to test this PR locally

Test Results:

--- Test results for package: google_workspace - START ---
╭──────────────────┬─────────────┬───────────┬──────────────────────────────────────────────┬────────┬──────────────╮
│ PACKAGE          │ DATA STREAM │ TEST TYPE │ TEST NAME                                    │ RESULT │ TIME ELAPSED │
├──────────────────┼─────────────┼───────────┼──────────────────────────────────────────────┼────────┼──────────────┤
│ google_workspace │ calendar    │ pipeline  │ (ingest pipeline warnings test-calendar.log) │ PASS   │ 393.736522ms │
│ google_workspace │ calendar    │ pipeline  │ test-calendar.log                            │ PASS   │ 734.878125ms │
╰──────────────────┴─────────────┴───────────┴──────────────────────────────────────────────┴────────┴──────────────╯
--- Test results for package: google_workspace - END   ---
Done

--- Test results for package: google_workspace - START ---
╭──────────────────┬─────────────┬───────────┬───────────┬────────┬───────────────╮
│ PACKAGE          │ DATA STREAM │ TEST TYPE │ TEST NAME │ RESULT │  TIME ELAPSED │
├──────────────────┼─────────────┼───────────┼───────────┼────────┼───────────────┤
│ google_workspace │ calendar    │ system    │ default   │ PASS   │ 39.641710282s │
╰──────────────────┴─────────────┴───────────┴───────────┴────────┴───────────────╯
--- Test results for package: google_workspace - END   ---
Done

Related issues

• Closes [Google Workspace]: Support calendar event type as a new data stream #13460

Screenshots

[elasticmachine]

Pinging @elastic/security-service-integrations (Team:Security-Service Integrations)

[elastic-vault-github-plugin-prod]

🚀 Benchmarks report

Package google_workspace 👍(7) 💚(4) 💔(6)

Expand to view

Data stream	Previous EPS	New EPS	Diff (%)	Result
groups	11904.76	9615.38	-2289.38 (-19.23%)	💔
saml	10000	5988.02	-4011.98 (-40.12%)	💔
chrome	2564.1	1733.1	-831 (-32.41%)	💔
context_aware_access	5617.98	3968.25	-1649.73 (-29.37%)	💔
data_studio	5524.86	4219.41	-1305.45 (-23.63%)	💔
drive	7246.38	5780.35	-1466.03 (-20.23%)	💔

To see the full report comment with /test benchmark fullreport

[efd6]

Please update the proposed commit message to say where/how the test case inputs were obtained.

[navnit-elastic]

Hi @efd6, Thanks for the review. I mostly agree with your suggestions and have applied the changes.
I am updating proposed message to include information about sample test logs and also updating the dashboard screenshots. Please have a look and let me know if anything needs to be changed.

[efd6]

Thanks. This is looking good. Minor query only.

[efd6]

Has this been regenerated? The user.name does not match the user.email.

[navnit-elastic]

Thanks Dan!

[efd6]

Same here.

[elasticmachine]

💚 Build Succeeded

• Buildkite Build
• Commit: af9d74c

History

• 💚 Build #24611 succeeded 0e5b40b
• 💚 Build #24600 succeeded c684085
• 💚 Build #24499 succeeded 6e3117f

cc @navnit-elastic

[elastic-sonarqube]

Quality Gate passed

Issues
0 New issues
0 Fixed issues
0 Accepted issues

Measures
0 Security Hotspots
97.6% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube

[efd6]

Thanks

[elastic-vault-github-plugin-prod]

Package google_workspace - 2.36.0 containing this change is available at https://epr.elastic.co/package/google_workspace/2.36.0/