feat(crowdstrike): add identity protection assessment data stream by navnit-elastic · Pull Request #18237 · elastic/integrations

navnit-elastic · 2026-04-07T07:40:06Z

Proposed commit message

feat(crowdstrike): add identity protection security assessment data stream

- Collect Falcon Identity Protection security assessments over GraphQL (domain
  list and per-domain assessments), with ingest pipeline, field mappings, tests,
  and benchmarks.
- Replace Markdown-based navigation on existing CrowdStrike dashboards with
  Kibana Links panels, and add a link to the new Identity Protection
  Assessments dashboard.

Pipeline and related test samples come from a live CrowdStrike tenant.

Docs (Elastic tenant):

Checklist

I have reviewed tips for building integrations and this pull request is aligned with them.
I have verified that all data streams collect metrics or logs.
I have added an entry to my package's changelog.yml file.
I have verified that Kibana version constraints are current according to guidelines.
I have verified that any added dashboard complies with Kibana's Dashboard good practices

Author's Checklist

[ ]

How to test this PR locally

Clone integrations repo.
Install elastic package locally.
Start elastic stack using elastic-package.
Move to integrations/packages/crowdstrike directory.
Run the following command to run tests.

elastic-package test

Related issues

Relates [CrowdStrike]: Add support for Falcon Identity Protection module #17846

Screenshots

crowdstrike-identity-protection-assessment-dashboard

add policy tests

github-actions · 2026-04-07T07:41:38Z

Vale Linting Results

Summary: 5 warnings found

⚠️ Warnings (5)

File	Line	Rule	Message
packages/crowdstrike/docs/README.md	3726	Elastic.Latinisms	Latin terms and abbreviations are a common source of confusion. Use 'for example' instead of 'e.g'.
packages/crowdstrike/docs/README.md	3727	Elastic.Latinisms	Latin terms and abbreviations are a common source of confusion. Use 'and so on' instead of 'etc'.
packages/crowdstrike/docs/README.md	3729	Elastic.QuotesPunctuation	Place punctuation inside closing quotation marks.
packages/crowdstrike/docs/README.md	3730	Elastic.Latinisms	Latin terms and abbreviations are a common source of confusion. Use 'for example' instead of 'e.g'.
packages/crowdstrike/docs/README.md	3731	Elastic.Latinisms	Latin terms and abbreviations are a common source of confusion. Use 'for example' instead of 'e.g'.

The Vale linter checks documentation changes against the Elastic Docs style guide.

To use Vale locally or report issues, refer to Elastic style guide for Vale.

add documentation add option to configure dataSources for domains add dashboard

…nstead

elastic-vault-github-plugin-prod · 2026-04-08T08:08:16Z

🚀 Benchmarks report

Package `crowdstrike` 👍(7) 💚(2) 💔(3)

Expand to view

Data stream	Previous EPS	New EPS	Diff (%)	Result
`falcon`	5555.56	3311.26	-2244.3 (-40.4%)	💔
`host`	4484.3	3135.78	-1348.52 (-30.07%)	💔
`alert`	1937.98	1607.72	-330.26 (-17.04%)	💔

To see the full report comment with /test benchmark fullreport

elasticmachine · 2026-04-08T08:36:21Z

Pinging @elastic/security-service-integrations (Team:Security-Service Integrations)

Add option to preserver duplicate custom fields Update dashboard

kcreddy

Just getting clarification on couple of script tests. Otherwise LGTM

kcreddy · 2026-04-30T10:31:32Z

Isn't this the same as previous test first_assessment just with DOMAIN_B error instead of DOMAIN_A error? Do we need to test both?

No, they are different. The intent is to test errors in sequence of requests (i.e. first request fails and second successes, first successes and second fails).

The first_assessment_http_500 validates that after a failure in a middle of work-list, the collector still continues and ingests event for the next domain.

The second_assessment_http_500 validates that when the first assessment succeeds but the second fails, we still get one assessment and one error.

If you think this is redundant and not required to test at this depth, we can skip the second_assessment_http_500 test case.

Yeah, lets remove second_assessment_http_500 its testing the same code block

navnit-elastic

@kcreddy, Please take a look at comment replies.

navnit-elastic · 2026-04-30T12:36:42Z

No, they are different. The intent is to test errors in sequence of requests (i.e. first request fails and second successes, first successes and second fails).

The first_assessment_http_500 validates that after a failure in a middle of work-list, the collector still continues and ingests event for the next domain.

The second_assessment_http_500 validates that when the first assessment succeeds but the second fails, we still get one assessment and one error.

If you think this is redundant and not required to test at this depth, we can skip the second_assessment_http_500 test case.

elasticmachine · 2026-05-04T12:46:10Z

💚 Build Succeeded

Buildkite Build
Commit: 702d4ac

History

💚 Build #42074 succeeded c3ca8fa
💔 Build #42065 failed 9355ca2
💔 Build #42050 failed afd5c3a
💔 Build #41995 failed 46eee1b
💚 Build #41984 succeeded 103a410
💔 Build #41983 failed fd34012

cc @navnit-elastic

kcreddy

LGTM. Thank you!

navnit-elastic added 3 commits March 30, 2026 12:06

add data collection logic, system tests

c541873

Merge branch 'main' into 17846-crowdstrike-idp-security_assessment

d9287d4

add rally and pipeline benchmark

e41c42d

add policy tests

navnit-elastic self-assigned this Apr 7, 2026

navnit-elastic force-pushed the 17846-crowdstrike-idp-security_assessment branch from 50bedb5 to ebe7297 Compare April 7, 2026 11:26

andrewkroh added dashboard Relates to a Kibana dashboard bug, enhancement, or modification. documentation Improvements or additions to documentation. Applied to PRs that modify *.md files. labels Apr 7, 2026

add script tests

f6c967c

add documentation add option to configure dataSources for domains add dashboard

navnit-elastic force-pushed the 17846-crowdstrike-idp-security_assessment branch from ebe7297 to f6c967c Compare April 7, 2026 12:07

fix CI failure: type double does not support enum values, use range i…

94f01b9

…nstead

navnit-elastic marked this pull request as ready for review April 8, 2026 08:36

navnit-elastic requested a review from a team as a code owner April 8, 2026 08:36

navnit-elastic added 2 commits April 8, 2026 15:06

update pr number in changelog yml

788090f

Merge branch 'main' into 17846-crowdstrike-idp-security_assessment

559e3ee

github-actions Bot mentioned this pull request Apr 27, 2026

CrowdStrike: ES|QL LOOKUP JOIN dashboard panels can hit default row limit (1000) #18648

Open

kcreddy reviewed Apr 27, 2026

View reviewed changes

navnit-elastic added 5 commits April 28, 2026 15:56

address pr comments

fd34012

Merge branch 'main' into 17846-crowdstrike-idp-security_assessment

0b07f43

regenerate readme.md

103a410

Add option to populate nested assessment factors

46eee1b

Add option to preserver duplicate custom fields Update dashboard

regenerate policy tests

afd5c3a

github-actions Bot mentioned this pull request Apr 29, 2026

[oblt-aw][agent-suggestions] Agent suggestions - 2026-04-29 elastic/oblt-actions#931

Closed

4 tasks

navnit-elastic added 2 commits April 29, 2026 13:51

fix script tests

9355ca2

add fields_under_root: true to fix configuration settings

c3ca8fa

navnit-elastic requested a review from kcreddy April 29, 2026 11:51

kcreddy reviewed Apr 30, 2026

View reviewed changes

navnit-elastic commented Apr 30, 2026

View reviewed changes

navnit-elastic added 2 commits May 4, 2026 17:14

fix fdr overview dashboard

6fdd8a7

remove second_assessment_http_500 script test case

702d4ac

navnit-elastic requested a review from kcreddy May 4, 2026 12:51

kcreddy approved these changes May 5, 2026

View reviewed changes

Conversation

navnit-elastic commented Apr 7, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Proposed commit message

Checklist

Author's Checklist

How to test this PR locally

Related issues

Screenshots

Uh oh!

github-actions Bot commented Apr 7, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Vale Linting Results

Uh oh!

elastic-vault-github-plugin-prod Bot commented Apr 8, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

🚀 Benchmarks report

Package crowdstrike 👍(7) 💚(2) 💔(3)

Uh oh!

elasticmachine commented Apr 8, 2026

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

kcreddy left a comment

Choose a reason for hiding this comment

Uh oh!

kcreddy Apr 30, 2026

Choose a reason for hiding this comment

Uh oh!

navnit-elastic Apr 30, 2026

Choose a reason for hiding this comment

Uh oh!

kcreddy Apr 30, 2026

Choose a reason for hiding this comment

Uh oh!

Uh oh!

navnit-elastic left a comment

Choose a reason for hiding this comment

Uh oh!

navnit-elastic Apr 30, 2026

Choose a reason for hiding this comment

Uh oh!

Uh oh!

elasticmachine commented May 4, 2026

💚 Build Succeeded

History

Uh oh!

kcreddy left a comment • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

4 participants

navnit-elastic commented Apr 7, 2026 •

edited

Loading

github-actions Bot commented Apr 7, 2026 •

edited

Loading

elastic-vault-github-plugin-prod Bot commented Apr 8, 2026 •

edited

Loading

Package `crowdstrike` 👍(7) 💚(2) 💔(3)

kcreddy left a comment •

edited

Loading