[axonius][alert_and_incident] Add Axonius Alert and Incident datastream

[muskan-agarwal26]

Proposed commit message

This new data stream collects alert findings and incidents data from the Axonius platform via the
/api/v2/assets/ endpoint. Axonius fields are mapped to their
corresponding ECS fields where possible.

Test samples were derived from live data samples, which were subsequently
sanitized.

API documentation: https://docs.axonius.com/docs/axonius-rest-api

Checklist

• I have reviewed tips for building integrations and this pull request is aligned with them.
• I have verified that all data streams collect metrics or logs.
• I have added an entry to my package's changelog.yml file.
• I have verified that Kibana version constraints are current according to guidelines.
• I have verified that any added dashboard complies with Kibana's Dashboard good practices

How to test this PR locally

To test the axonius package:

• Clone integrations repo.
• Install elastic package locally.
• Start elastic stack using elastic-package.
• Move to integrations/packages/axonius directory.
• Run the following command to run tests.

elastic-package test

2025/12/17 18:21:56  INFO New version is available - v0.117.1. Download from: https://github.com/elastic/elastic-package/releases/tag/v0.117.1
Run asset tests for the package
2025/12/17 18:21:57  INFO License text found in "/root/GITHUB/integrations/LICENSE.txt" will be included in package
--- Test results for package: axonius - START ---
╭─────────┬────────────────────┬───────────┬──────────────────────────────────────────────────────────────────┬────────┬──────────────╮
│ PACKAGE │ DATA STREAM        │ TEST TYPE │ TEST NAME                                                        │ RESULT │ TIME ELAPSED │
├─────────┼────────────────────┼───────────┼──────────────────────────────────────────────────────────────────┼────────┼──────────────┤
│ axonius │                    │ asset     │ dashboard axonius-50841034-1314-4e26-8be3-47d38241c359 is loaded │ PASS   │      2.703µs │
│ axonius │                    │ asset     │ search axonius-852dd7b3-5b99-456b-8f00-9db6b8d6f4bd is loaded    │ PASS   │        481ns │
│ axonius │                    │ asset     │ search axonius-d3b2048c-016a-4ebb-9406-89687aa90aee is loaded    │ PASS   │        546ns │
│ axonius │ alert_and_incident │ asset     │ index_template logs-axonius.alert_and_incident is loaded         │ PASS   │        696ns │
│ axonius │ alert_and_incident │ asset     │ ingest_pipeline logs-axonius.alert_and_incident-0.1.0 is loaded  │ PASS   │        345ns │
╰─────────┴────────────────────┴───────────┴──────────────────────────────────────────────────────────────────┴────────┴──────────────╯
--- Test results for package: axonius - END   ---
Done
Run pipeline tests for the package
--- Test results for package: axonius - START ---
╭─────────┬────────────────────┬───────────┬───────────────────────────────────────────────────┬────────┬──────────────╮
│ PACKAGE │ DATA STREAM        │ TEST TYPE │ TEST NAME                                         │ RESULT │ TIME ELAPSED │
├─────────┼────────────────────┼───────────┼───────────────────────────────────────────────────┼────────┼──────────────┤
│ axonius │ alert_and_incident │ pipeline  │ (ingest pipeline warnings test-alert-finding.log) │ PASS   │ 726.121672ms │
│ axonius │ alert_and_incident │ pipeline  │ (ingest pipeline warnings test-incident.log)      │ PASS   │ 712.669141ms │
│ axonius │ alert_and_incident │ pipeline  │ test-alert-finding.log                            │ PASS   │ 194.767219ms │
│ axonius │ alert_and_incident │ pipeline  │ test-incident.log                                 │ PASS   │ 209.348823ms │
╰─────────┴────────────────────┴───────────┴───────────────────────────────────────────────────┴────────┴──────────────╯
--- Test results for package: axonius - END   ---
Done
Run policy tests for the package
--- Test results for package: axonius - START ---
No test results
--- Test results for package: axonius - END   ---
Done
Run static tests for the package
--- Test results for package: axonius - START ---
╭─────────┬────────────────────┬───────────┬──────────────────────────┬────────┬──────────────╮
│ PACKAGE │ DATA STREAM        │ TEST TYPE │ TEST NAME                │ RESULT │ TIME ELAPSED │
├─────────┼────────────────────┼───────────┼──────────────────────────┼────────┼──────────────┤
│ axonius │ alert_and_incident │ static    │ Verify sample_event.json │ PASS   │ 220.387313ms │
╰─────────┴────────────────────┴───────────┴──────────────────────────┴────────┴──────────────╯
--- Test results for package: axonius - END   ---
Done
Run system tests for the package
2025/12/17 18:22:05  INFO Installing package...
2025/12/17 18:22:05  INFO License text found in "/root/GITHUB/integrations/LICENSE.txt" will be included in package
2025/12/17 18:22:16  INFO Running test for data_stream "alert_and_incident" with configuration 'default'
2025/12/17 18:22:25  INFO Setting up independent Elastic Agent...
2025/12/17 18:22:39  INFO Setting up service...
2025/12/17 18:23:03  INFO Validating test case...
2025/12/17 18:23:04  INFO Tearing down service...
2025/12/17 18:23:05  INFO Write container logs to file: /root/GITHUB/integrations/build/container-logs/axonius-1765975985552405152.log
2025/12/17 18:23:08  INFO Tearing down agent...
2025/12/17 18:23:08  INFO Write container logs to file: /root/GITHUB/integrations/build/container-logs/elastic-agent-1765975988989458774.log
2025/12/17 18:23:36  INFO Uninstalling package...
--- Test results for package: axonius - START ---
╭─────────┬────────────────────┬───────────┬───────────┬────────┬───────────────╮
│ PACKAGE │ DATA STREAM        │ TEST TYPE │ TEST NAME │ RESULT │  TIME ELAPSED │
├─────────┼────────────────────┼───────────┼───────────┼────────┼───────────────┤
│ axonius │ alert_and_incident │ system    │ default   │ PASS   │ 47.688153488s │
╰─────────┴────────────────────┴───────────┴───────────┴────────┴───────────────╯
--- Test results for package: axonius - END   ---
Done

Related issues

• Relates [New Integration] Axonius #15034
• Relates [axonius] - Fix Cannot execute ILM policy delete step in other datastreams elasticsearch#139512

Screenshots

[chrisberkhout]

Had a high-level look and I have a few questions about the approach.

I see that this is a PR to a feature branch rather than to main. That's fine, but it would have been helpful to mention that in the PR description and maybe one sentence about the scope of this PR and where it fits in the project.

[cla-checker-service]

💚 CLA has been signed

[chrisberkhout]

Thanks for splitting the alert_and_incident data stream into alert_finding and incident data streams!

Regarding the other points from the last review, I checked each and made some comments. I think most of those still need some attention.

[chrisberkhout]

Please review the unresolved items from earlier reviews.