[Workday][Sign-on] Add Sign-on data stream (#20039)

This PR adds the `sign_on` data stream to the Workday integration, along
with its associated dashboard and visualizations.

Workday fields are mapped to their corresponding ECS fields where
possible.

Test samples were derived from live data samples, which were
subsequently sanitized.

Author: muskan-agarwal26

packages/workday/_dev/build/build.yml

@@ -1,3 +1,3 @@
 dependencies:
   ecs:
-    reference: git@v9.3.0
+    reference: git@v9.4.0

packages/workday/_dev/build/docs/README.md

@@ -4,35 +4,36 @@
 
 [Workday](https://www.workday.com/en-in/homepage.html) is a cloud-based ERP system that manages business processes and allows organizations to use an integrated application. Workday is a coherent cloud ERP system for financial analysis, analytical solutions, HCM suites, and better business processes.
 
-The Workday integration for Elastic collects `Activity Logs` via **API** and visualizes them in Kibana.
+The Workday integration for Elastic collects `Activity` logs via the **Workday API** and `Sign-on` logs via the **Workday Custom Report API**, and visualizes them in Kibana.
 
 ### Compatibility
 
-The Workday integration is compatible with API version **v1**.
+- The **Activity** data stream is compatible with Workday API version **v1**.
+- The **Sign-on** data stream is compatible with Workday Custom Reports exposed via the **Reports as a Service (RaaS)** JSON endpoint (`/ccx/service/customreport2/...?format=json`).
 
 ### How it works
 
-This integration periodically queries the Workday API to retrieve logs.
+- **Activity**: This integration periodically queries the Workday API to retrieve Activity logs.
+- **Sign-on**: This integration periodically downloads a Workday Custom Report (for example, a Sign-on report that lists sign-on records along with their key attributes) and ingests each report row as a single event.
 
 ## What data does this integration collect?
 
-This integration collects log messages of the following type:
+This integration collects log messages of the following types:
 
-- `Activity`: Collects [Activity Logs](https://community.workday.com/sites/default/files/file-hosting/restapi/#privacy/v1/get-/activityLogging) logs via Workday API (endpoint: `/activityLogging`).
+- `Activity`: Collects [Activity Logs](https://community.workday.com/sites/default/files/file-hosting/restapi/#privacy/v1/get-/activityLogging) via the Workday API (endpoint: `/activityLogging`).
+- `Sign-on`: Collects sign-on information from a Workday Custom Report via the Workday Reports as a Service (RaaS) JSON endpoint.
 
 ### Supported use cases
 
-Integrating Workday with Elastic gives security and IT teams centralized visibility into **Workday activity logging**, so you can monitor configuration and usage changes, support audits, and investigate suspicious behavior from Kibana.
+Integrating Workday with Elastic gives security and IT teams centralized visibility into **Workday activity logging** and **Workday sign-on data**, so you can monitor configuration and usage changes, track sign-on activity and access patterns, support audits, and investigate suspicious or unusual authentication behavior from Kibana.
 
-The **Activity** dashboard summarizes key patterns such as **activity volume over time** and **top actors**, helping you spot unusual spikes and focus on the users and operations that matter.
-
-Built-in filters make it easier to narrow events by attributes such as **task**, **system account**, and **IP address**, which supports faster triage and a more consistent investigation workflow across your Workday telemetry.
+The **Activity** dashboard summarizes key patterns such as **activity volume over time** and **top actors**, helping you spot unusual spikes and focus on the users and operations that matter. Built-in filters make it easier to narrow events by attributes such as **task**, **system account**, and **IP address**, which supports faster triage and a more consistent investigation workflow across your Workday telemetry.
 
 ## What do I need to use this integration?
 
 ### From Workday
 
-#### Collect Workday API credentials
+#### For the Activity data stream
 
 ##### Enable User Activity Logging
 
@@ -43,7 +44,7 @@ Built-in filters make it easier to narrow events by attributes such as **task**,
 
 **Note:** Once enabled, Workday records all user activity in a secure tenant database. Activity logging must be enabled before any logs are available for export.
 
-#### Create Integration System User (ISU)
+##### Create Integration System User (ISU)
 
 1. In the Workday search bar, search for Create Integration System User.
 2. Enter a User Name (for example, ISU_SIEM_Export) and a strong Password.
@@ -54,7 +55,7 @@ Built-in filters make it easier to narrow events by attributes such as **task**,
 7. Search for View Domain and locate the User Activity Logging domain. Grant Get access to the ISU security group for this domain.
 8. Search for Activate Pending Security Policy Changes and activate the changes.
 
-#### Register API client for OAuth
+##### Register API client for OAuth
 
 1. In the Workday search bar, search for Register API Client for Integrations.
 2. Enter a Client Name (for example, SIEM_OAuth_Client).
@@ -69,7 +70,7 @@ Built-in filters make it easier to narrow events by attributes such as **task**,
 9. Generate a new refresh token for the API client.
 10. Copy and save the Refresh Token.
 
-#### Determine tenant URL
+##### Determine tenant URL
 
 The API endpoint is based on your Workday tenant. The format is:
 
@@ -83,6 +84,43 @@ Activity Logging API |	https://HOST/ccx/api/privacy/v1/TENANT/activityLogging
 
 **Note:** For additional Workday API security context, see [Generating API Keys for the Workday API](https://workday.my.site.com/customercenter/article?no=000013105&redirect=false).
 
+#### For the Sign-on data stream
+
+##### Build the Sign-on custom report
+
+1. Sign in to your Workday tenant as a user with report-authoring privileges.
+2. In the Workday search bar, search for **Create Custom Report**.
+3. Create an Advanced report on a data source that exposes sign-on activity (for example, `Signons and Attempted Signons`).
+4. Add the columns required for sign-on analytics (for example, `System Account`, `Session Start`, `Session End`, `Authentication Type for Signon`, `Failed Signon`, `Invalid Credentials`, `Account Locked, Disabled or Expired`, `Browser Type`, `Operating System`, `Device Type`, `Request Originator`, `SAML Identity Provider`).
+5. On the **Advanced** tab, select **Enable As Web Service** so the report is exposed as Reports as a Service (RaaS).
+6. Save the report and note the **Report Name** and the **Report Owner** (the Workday account that owns the report).
+
+##### Create the Integration System User (ISU)
+
+1. In the Workday search bar, search for **Create Integration System User**.
+2. Enter a User Name (for example, `ISU_SIEM_Export`) and a strong Password.
+3. Clear the **Require New Password at Next Sign In** checkbox.
+4. Click **OK**.
+5. Search for **Create Security Group** and create an Integration System Security Group (Unconstrained).
+6. Add the ISU (`ISU_SIEM_Export`) to this security group.
+7. Grant the ISU security group access to the domain protecting the custom report's data source (for example, the `System Auditing` domain).
+8. Search for **Activate Pending Security Policy Changes** and activate the changes.
+
+##### Determine the report URL
+
+The Custom Report endpoint URL has the following format:
+
+```
+https://HOST/ccx/service/customreport2/TENANT/REPORT_OWNER/REPORT_NAME?format=json
+```
+
+Where:
+
+- `HOST` is your Workday hostname.
+- `TENANT` is your Workday tenant name.
+- `REPORT_OWNER` is the Workday account that owns the custom report.
+- `REPORT_NAME` is the name of the custom report you created above.
+
 ## How do I deploy this integration?
 
 This integration supports both Elastic Agentless-based and Agent-based installations.
@@ -105,7 +143,7 @@ Elastic Agent must be installed. For more details, check the Elastic Agent [inst
 4. Select **Add Workday** to add the integration.
 5. Enable and configure only the collection methods which you will use.
 
-    * To **Collect Workday logs via API**, you'll need to:
+    * To **Collect Workday Activity logs via API**, you'll need to:
 
         - Configure **Hostname**.
         - Configure **Tenant**.
@@ -114,6 +152,12 @@ Elastic Agent must be installed. For more details, check the Elastic Agent [inst
         - Configure **Refresh Token**.
         - Adjust the integration configuration parameters if required, including the **Interval**, **Initial Interval**, **Preserve original event** etc. to enable data collection.
 
+    * To **Collect Workday Sign-on logs via Custom Report API**, you'll need to:
+
+        - Configure **Report URL** with the full Workday Custom Report (RaaS) URL noted above.
+        - Configure **Username** and **Password** for basic authentication against the Workday Custom Report API.
+        - Adjust the integration configuration parameters if required, including the **Interval** and **Preserve original event** etc. to enable data collection.
+
 6. Select **Save and continue** to save the integration.
 
 ### Validation
@@ -140,6 +184,10 @@ For more information on architectures that can be used for scaling this integrat
 
 {{fields "activity"}}
 
+#### Sign-on
+
+{{fields "sign_on"}}
+
 ### Example event
 
 #### Activity
@@ -148,12 +196,17 @@ For more information on architectures that can be used for scaling this integrat
 
 ### Inputs used
 
-These input is used in the integration:
+These inputs are used in the integration:
 
 - [CEL](https://www.elastic.co/docs/reference/beats/filebeat/filebeat-input-cel)
 
 ### API usage
 
-This integration uses the following Workday API:
+This integration uses the following Workday APIs:
+
+- **Activity**: [Workday Activity API documentation](https://community.workday.com/sites/default/files/file-hosting/restapi/#privacy/v1/get-/activityLogging).
+- **Sign-on**: The Workday **Reports as a Service (RaaS)** JSON endpoint is used to fetch a user-defined Sign-on custom report:
 
-**Activity**: [Workday Activity API documentation](https://community.workday.com/sites/default/files/file-hosting/restapi/#privacy/v1/get-/activityLogging).
+```
+GET https://HOST/ccx/service/customreport2/TENANT/REPORT_OWNER/REPORT_NAME?format=json
+```

packages/workday/changelog.yml

@@ -1,4 +1,9 @@
 # newer versions go on top
+- version: '0.3.0'
+  changes:
+    - description: Add support for sign_on data stream.
+      type: enhancement
+      link: https://github.com/elastic/integrations/pull/20039
 - version: '0.2.0'
   changes:
     - description: Fix token refresh after 401 by adding TTL-based expiry tracking.

packages/workday/data_stream/activity/_dev/test/system/test-common-config.yml

@@ -1,11 +1,6 @@
 input: cel
 service: workday
 vars:
-  hostname: "{{Hostname}}:{{Port}}"
-  tenant: tenant
-  client_id: client_id
-  client_secret: client_secret
-  refresh_token: refresh_token
   ssl: |
     certificate_authorities:
       - |
@@ -30,6 +25,11 @@ vars:
         -----END CERTIFICATE-----
 data_stream:
   vars:
+    hostname: "{{Hostname}}:{{Port}}"
+    tenant: tenant
+    client_id: client_id
+    client_secret: client_secret
+    refresh_token: refresh_token
     preserve_original_event: true
     batch_size: 2
 assert:

packages/workday/data_stream/activity/manifest.yml

@@ -6,6 +6,41 @@ streams:
     description: Collect Activity logs from Workday.
     template_path: cel.yml.hbs
     vars:
+      - name: hostname
+        type: text
+        title: Hostname
+        description: 'Hostname of Workday instance. Example: <your-workday-host>.workday.com'
+        required: true
+        show_user: true
+      - name: tenant
+        type: text
+        title: Tenant
+        description: Tenant of Workday instance.
+        required: true
+        show_user: true
+      - name: client_id
+        type: text
+        title: Client ID
+        multi: false
+        required: true
+        show_user: true
+        description: Client ID.
+      - name: client_secret
+        type: password
+        title: Client Secret
+        multi: false
+        required: true
+        show_user: true
+        secret: true
+        description: Client Secret.
+      - name: refresh_token
+        type: text
+        title: Refresh Token
+        description: Refresh token for Workday instance.
+        multi: false
+        required: true
+        show_user: true
+        secret: true
       - name: initial_interval
         type: text
         title: Initial Interval

packages/workday/data_stream/sign_on/_dev/test/pipeline/test-sign-on.log

@@ -0,0 +1,10 @@
+{"Account_Locked__Disabled_or_Expired":"0","Active_Session":"0","Authentication_Type_for_Signon":"SAML","Browser_Type":"Chrome","Device_Type":"Desktop","Device_is_Trusted":"0","Failed_Signon":"0","Forgotten_Password_Reset_Request":"0","Invalid_Credentials":"0","Is_Device_Managed":"0","Operating_System":"Mac OS X","Password_Changed":"0","Request_Originator":"UI","SAML_Identity_Provider":"IdP_Acme","Session_End":"2026-06-18T23:25:22-07:00","Session_Start":"2026-06-18T16:59:32-07:00","System_Account":"user534.acme / User 534"}
+{"Account_Locked__Disabled_or_Expired":"0","Active_Session":"0","Authentication_Type_for_Signon":"OAuth 2.0","Device_is_Trusted":"0","Failed_Signon":"0","Forgotten_Password_Reset_Request":"0","Invalid_Credentials":"0","Is_Device_Managed":"0","Password_Changed":"0","Request_Originator":"Internal","Session_End":"2026-06-18T22:55:34-07:00","Session_Start":"2026-06-18T16:55:34-07:00","System_Account":"ISU_Integration_049"}
+{"Account_Locked__Disabled_or_Expired":"0","Active_Session":"0","Authentication_Failure_Message":"Mobile PIN has expired. To reset your PIN, first sign in using your user name and password.","Authentication_Type_for_Signon":"Biometric","Browser_Type":"Workday Phone App","Device_Type":"Phone","Device_is_Trusted":"0","Failed_Signon":"1","Forgotten_Password_Reset_Request":"0","Invalid_Credentials":"0","Is_Device_Managed":"0","Operating_System":"iOS","Password_Changed":"0","Request_Originator":"UI","Session_Start":"2026-06-18T16:52:43-07:00","System_Account":"user179.acme / User 179","UI_Client_Type":"iPhone Native"}
+{"Account_Locked__Disabled_or_Expired":"0","Active_Session":"0","Authentication_Type_for_Signon":"SAML","Browser_Type":"Workday Phone App","Device_Type":"Phone","Device_is_Trusted":"0","Failed_Signon":"0","Forgotten_Password_Reset_Request":"0","Invalid_Credentials":"0","Is_Device_Managed":"0","Operating_System":"iOS","Password_Changed":"0","Request_Originator":"UI","SAML_Identity_Provider":"IdP_Acme","Session_End":"2026-06-18T22:59:33-07:00","Session_Start":"2026-06-18T16:57:04-07:00","System_Account":"user179.acme / User 179"}
+{"Account_Locked__Disabled_or_Expired":"0","Active_Session":"1","Authentication_Type_for_Signon":"User Name Password","Device_is_Trusted":"0","Failed_Signon":"0","Forgotten_Password_Reset_Request":"0","Invalid_Credentials":"0","Is_Device_Managed":"0","Password_Changed":"0","Request_Originator":"Web Services","Session_Start":"2026-06-18T13:18:51-07:00","System_Account":"ISU_Integration_001"}
+{"Authentication_Type":"SAML","Browser_Type":"Chrome","Created_Moment":"2026-06-22T01:08:10.374-07:00","Device_Type":"Desktop","Device_is_Trusted":"0","Operating_System":"Mac OS X","Prompt_-_Positive_Integer":"linda.andersson / Linda Andersson","Request_Originator":"UI","SAML_Identity_Provider":"Okta E2","Session_ID":"4562a3","Sign-on_Time":"2026-06-22T01:08:10-07:00","Signoff_Time":"2026-06-22T02:09:01-07:00","Signon_IP_Address":"81.2.69.142","Signon_Worker":"Linda Andersson (006193)","User_Agent":"Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/149.0.0.0 Safari/537.36","userName":"linda.andersson"}
+{"Authentication_Type":"User Name Password","Browser_Type":"Chrome","Created_Moment":"2026-06-22T00:44:17.617-07:00","Device_Type":"Desktop","Device_is_Trusted":"0","Operating_System":"Mac OS X","Prompt_-_Positive_Integer":"alina.goajga / Alina Garagancea","Request_Originator":"UI","Session_ID":"b40162","Sign-on_Time":"2026-06-22T00:44:17-07:00","Signoff_Time":"2026-06-22T03:35:15-07:00","Signon_IP_Address":"81.2.69.144","Signon_Worker":"Alina Garagancea (002036)","User_Agent":"Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/149.0.0.0 Safari/537.36","userName":"alina.goajga"}
+{"Authentication_Type":"Trusted","Created_Moment":"2026-06-22T00:04:11.094-07:00","Device_Type":"Desktop","Device_is_Trusted":"0","Prompt_-_Positive_Integer":"ISU_Adaptive_Insights_User_Provisioning","Request_Originator":"Internal","Session_ID":"89d613","Sign-on_Time":"2026-06-22T00:04:11-07:00","Signoff_Time":"2026-06-22T01:04:11-07:00","Signon_IP_Address":"Workday Internal","userName":"ISU_Adaptive_Insights_User_Provisioning"}
+{"Authentication_Type":"OAuth 2.0","Created_Moment":"2026-06-22T04:29:16.382-07:00","Device_is_Trusted":"0","Prompt_-_Positive_Integer":"ISU_WD_Logs","Request_Originator":"Internal","Session_ID":"87ed78","Sign-on_Time":"2026-06-22T04:29:16-07:00","Signoff_Time":"2026-06-22T05:29:16-07:00","Signon_IP_Address":"89.160.20.112","userName":"ISU_WD_Logs"}
+{"Authentication_Failure_Message":"Invalid password","Authentication_Type":"User Name Password","Browser_Type":"Chrome","Created_Moment":"2026-06-22T06:41:11.320-07:00","Device_Type":"Desktop","Device_is_Trusted":"0","Operating_System":"Mac OS X","Prompt_-_Positive_Integer":"chris.carnes / Chris Carnes","Request_Originator":"UI","Sign-on_Time":"2026-06-22T06:41:11-07:00","Signon_IP_Address":"175.16.199.1","Signon_Worker":"Chris Carnes (006423)","User_Agent":"Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/149.0.0.0 Safari/537.36","userName":"chris.carnes"}