[lumos] Fix activity logs cursor so incremental collection filters requests by the stored timestamp

[brijesh-elastic]

Proposed commit message

lumos: Fix activity logs cursor so incremental collection filters requests by the stored timestamp
instead of replaying the full history each interval

Lumos Activity API details are (here)[1].

[1] https://developers.lumos.com/reference/getactivitylogs-1

Note

To Reviewers:

• This changes has not been tested with a live instance.

Checklist

• I have reviewed tips for building integrations and this pull request is aligned with them.
• I have verified that all data streams collect metrics or logs.
• I have added an entry to my package's changelog.yml file.
• I have verified that Kibana version constraints are current according to guidelines.
• I have verified that any added dashboard complies with Kibana's Dashboard good practices

How to test this PR locally

• Clone integrations repo.
• Install elastic package locally.
• Start elastic stack using elastic-package.
• Move to integrations/packages/lumos directory.
• Run the following command to run tests.

elastic-package test -v

Related issues

• Closes [httpjson-pagination] Lumos activity_logs cursor is never applied, causing full replay each interval #18494

[infra-vault-gh-plugin-prod]

Pinging @elastic/security-service-integrations (Team:Security-Service Integrations)

[github-actions]

✅ Elastic Docs Style Checker (Vale)

No issues found on modified lines!

---

The Vale linter checks documentation changes against the Elastic Docs style guide. To use Vale locally or report issues, refer to Elastic style guide for Vale.

[vera-review-bot]

No issues across the latest commits 2979d68.

A new commit triggers another review — at most once every 15 minutes. I skip the PR while it's approved or has merge conflicts.

🤖 AI-Generated Review | Vera Review Bot | 📚 Knowledge base: integration-skills

⚠️ Automated review — verify suggestions before applying.

[elastic-vault-github-plugin-prod]

🚀 Benchmarks report

To see the full report comment with /test benchmark fullreport

[ShourieG]

LGTM

[mergify]

Tick the box to add this pull request to the merge queue (same as @mergifyio queue).

• Queue this pull request

[efd6]

Suggested change

	"given_name": "Wile"
	"given_name": "Wile E."

[elastic-vault-github-plugin-prod]

✅ All changelog entries have the correct PR link.

[infra-vault-gh-plugin-prod]

💚 Build Succeeded

• Buildkite Build
• Commit: 0e1eaad

History

• 💚 Build #46444 succeeded 2979d68

cc @brijesh-elastic

[elastic-vault-github-plugin-prod]

Package lumos - 1.8.1 containing this change is available at https://epr.elastic.co/package/lumos/1.8.1/