Skip to content

[sailpoint_identity_sc] Add machine_identities data stream#20198

Open
chemamartinez wants to merge 2 commits into
elastic:mainfrom
chemamartinez:18836-sailpoint-machine-identities-data-stream
Open

[sailpoint_identity_sc] Add machine_identities data stream#20198
chemamartinez wants to merge 2 commits into
elastic:mainfrom
chemamartinez:18836-sailpoint-machine-identities-data-stream

Conversation

@chemamartinez

Copy link
Copy Markdown
Contributor

Proposed commit message

Add the `machine_identities` data stream to collect machine identity
records from the SailPoint Machine Identities API
(`GET /{api_version}/machine-identities`) using offset+limit pagination.

Records are modelled as ECS `service.*` assets (`event.kind: asset`,
`event.category: iam`) with owner references mapped to `related.user`.

An overview Kibana dashboard is included.

API endpoint reference: https://developer.sailpoint.com/redoc/sailpoint-api-v2026-light.html#tag/Machine-Identities/operation/listMachineIdentities

Checklist

  • I have reviewed tips for building integrations and this pull request is aligned with them.
  • I have verified that all data streams collect metrics or logs.
  • I have added an entry to my package's changelog.yml file.
  • I have verified that Kibana version constraints are current according to guidelines.
  • I have verified that any added dashboard complies with Kibana's Dashboard good practices

Related issues

Screenshots

image image image

@chemamartinez chemamartinez self-assigned this Jul 17, 2026
@chemamartinez chemamartinez added enhancement New feature or request Team:Security-Service Integrations Security Service Integrations team [elastic/security-service-integrations] Integration:sailpoint_identity_sc Sailpoint Identity Security Cloud labels Jul 17, 2026
@chemamartinez
chemamartinez marked this pull request as ready for review July 17, 2026 18:06
@chemamartinez
chemamartinez requested review from a team as code owners July 17, 2026 18:06
@infra-vault-gh-plugin-prod

Copy link
Copy Markdown

Pinging @elastic/security-service-integrations (Team:Security-Service Integrations)

@github-actions

Copy link
Copy Markdown
Contributor

Elastic Docs Style Checker (Vale)

Summary: 2 warnings found

⚠️ Warnings (2): Fix when the suggestion improves clarity or correctness.
File Line Rule Message
packages/sailpoint_identity_sc/_dev/build/docs/README.md 59 Elastic.DontUse Don't use 'Please'.
packages/sailpoint_identity_sc/manifest.yml 59 Elastic.Latinisms Latin terms and abbreviations are a common source of confusion. Use 'for example' instead of 'e.g'.

The Vale linter checks documentation changes against the Elastic Docs style guide. To use Vale locally or report issues, refer to Elastic style guide for Vale.

@elastic-vault-github-plugin-prod

Copy link
Copy Markdown
Contributor

✅ All changelog entries have the correct PR link.

@vera-review-bot

Copy link
Copy Markdown

⚠️ @chemamartinez I couldn't complete the review for commits 0bef80d after several attempts. A maintainer can re-run it with @vera-review-bot review.

@elastic-vault-github-plugin-prod

Copy link
Copy Markdown
Contributor

🚀 Benchmarks report

To see the full report comment with /test benchmark fullreport

@infra-vault-gh-plugin-prod

Copy link
Copy Markdown

💚 Build Succeeded

cc @chemamartinez

@andrewkroh andrewkroh added documentation Improvements or additions to documentation. Applied to PRs that modify *.md files. dashboard Relates to a Kibana dashboard bug, enhancement, or modification. labels Jul 17, 2026
"events": {
"error": {
"code": string(resp.StatusCode),
"id": string(resp.Status),

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Suggested change
"id": string(resp.Status),
"id": resp.Status,

(size(resp.Body) != 0) ?
string(resp.Body)
:
string(resp.Status) + " (" + string(resp.StatusCode) + ")"

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Suggested change
string(resp.Status) + " (" + string(resp.StatusCode) + ")"
resp.Status + " (" + string(resp.StatusCode) + ")"

- "sp:search:read"
- "idn:mis-identity:read"
- "idn:mis-identity:manage"
- name: enable_request_tracer

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Can we move this to the data stream level? Maybe in a follow-up.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

dashboard Relates to a Kibana dashboard bug, enhancement, or modification. documentation Improvements or additions to documentation. Applied to PRs that modify *.md files. enhancement New feature or request Integration:sailpoint_identity_sc Sailpoint Identity Security Cloud Team:Security-Service Integrations Security Service Integrations team [elastic/security-service-integrations]

Projects

None yet

Development

Successfully merging this pull request may close these issues.

3 participants