Skip to content

[sysdig] Add support for cspm datastream #14907

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom
Open
wants to merge 2 commits into
base: main
Choose a base branch
from
Open

[sysdig] Add support for cspm datastream #14907

wants to merge 2 commits into from
+2,097 −5

Conversation

brijesh-elastic
Copy link
Collaborator

Proposed commit message

sysdig: add support for cspm data stream to collect compliance results.

The CSPM data stream logs provide an overview of the evaluation results of your
Cloud and Kubernetes environment’s adherence to specific security standards,
regulations, and policies. The findings highlight areas where your organization
is meeting or failing to meet the required security controls and procedures.

Sanitized test case inputs were obtained from live Sysdig Secure instance
using the Sysdig API.

Note

The dashboard will be added once the vulnerability PR is merged.

Checklist

  • I have reviewed tips for building integrations and this pull request is aligned with them.
  • I have verified that all data streams collect metrics or logs.
  • I have added an entry to my package's changelog.yml file.
  • I have verified that Kibana version constraints are current according to guidelines.
  • I have verified that any added dashboard complies with Kibana's Dashboard good practices

How to test this PR locally

  • Clone integrations repo.
  • Install elastic package locally.
  • Start elastic stack using elastic-package.
  • Move to integrations/packages/sysdig directory.
  • Run the following command to run tests.

elastic-package test

Related issues

@brijesh-elastic brijesh-elastic self-assigned this Aug 12, 2025
@brijesh-elastic brijesh-elastic requested a review from a team as a code owner August 12, 2025 10:14
@brijesh-elastic brijesh-elastic added documentation Improvements or additions to documentation. Applied to PRs that modify *.md files. enhancement New feature or request Team:Security-Service Integrations Security Service Integrations team [elastic/security-service-integrations] Integration:sysdig Sysdig Team:Sit-Crest Crest developers on the Security Integrations team [elastic/sit-crest-contractors] labels Aug 12, 2025
@elasticmachine
Copy link

Pinging @elastic/security-service-integrations (Team:Security-Service Integrations)

@elastic-vault-github-plugin-prod
Copy link

🚀 Benchmarks report

To see the full report comment with /test benchmark fullreport

@elasticmachine
Copy link

💚 Build Succeeded

cc @brijesh-elastic

@elastic-sonarqube Elastic SonarQube
Copy link

Quality Gate passed Quality Gate passed

Issues
0 New issues
0 Fixed issues
0 Accepted issues

Measures
0 Security Hotspots
93.4% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube

efd6
efd6 reviewed Aug 14, 2025
View reviewed changes
Copy link
Contributor

@efd6 efd6 left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

nit only, otherwise LGTM

packages/sysdig/changelog.yml
@@ -1,4 +1,9 @@
# newer versions go on top
- version: "2.1.0"
changes:
- description: Add support for cspm datastream.
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Suggested change
- description: Add support for cspm datastream.
- description: Add support for CSPM data stream.

packages/sysdig/data_stream/cspm/elasticsearch/ingest_pipeline/default.yml
}
// Apply the conversion
ctx.sysdig = ctx.sysdig ?: [:];
if (ctx.json != null) {
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Can we not put this in an if: ctx.json != null instead of doing it here?

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Reviewers

@efd6 efd6 efd6 left review comments

At least 1 approving review is required to merge this pull request.

Assignees

@brijesh-elastic brijesh-elastic

Labels
documentation Improvements or additions to documentation. Applied to PRs that modify *.md files. enhancement New feature or request Integration:sysdig Sysdig Team:Security-Service Integrations Security Service Integrations team [elastic/security-service-integrations] Team:Sit-Crest Crest developers on the Security Integrations team [elastic/sit-crest-contractors]
Projects
None yet
Milestone
No milestone
Development

Successfully merging this pull request may close these issues.

[Sysdig Secure] New data stream: CSPM
3 participants
@brijesh-elastic @elasticmachine @efd6