[island_browser][compromised_credential] Add island_browser compromised credential datastream #15372

janvi-elastic · 2025-09-17T13:16:38Z

Proposed commit message

The release includes compromised credential data stream, associated dashboards 
and visualizations.

Island Browser fields are mapped to their corresponding ECS fields where possible.

Test samples were derived from documentation.

Checklist

I have reviewed tips for building integrations and this pull request is aligned with them.
I have verified that all data streams collect metrics or logs.
I have added an entry to my package's changelog.yml file.
I have verified that Kibana version constraints are current according to guidelines.

How to test this PR locally

Clone integrations repo.
Install elastic package locally.
Start elastic stack using elastic-package.
Move to integrations/packages/island_browser directory.
Run the following command to run tests.

elastic-package test

Run asset tests for the package
--- Test results for package: island_browser - START ---
╭────────────────┬────────────────────────┬───────────┬────────────────────────────────────────────────────────────────────────────┬────────┬──────────────╮
│ PACKAGE        │ DATA STREAM            │ TEST TYPE │ TEST NAME                                                                  │ RESULT │ TIME ELAPSED │
├────────────────┼────────────────────────┼───────────┼────────────────────────────────────────────────────────────────────────────┼────────┼──────────────┤
│ island_browser │                        │ asset     │ dashboard island_browser-1bcda810-8ace-46ea-9a41-f9179ac63f36 is loaded    │ PASS   │      1.483µs │
│ island_browser │                        │ asset     │ dashboard island_browser-86a8fe6b-5da7-4584-a376-ac52a9d4d7a2 is loaded    │ PASS   │        402ns │
│ island_browser │                        │ asset     │ dashboard island_browser-8a93ddf1-8cd3-4316-bf78-eaaa15af9e8c is loaded    │ PASS   │        359ns │
│ island_browser │                        │ asset     │ search island_browser-84eb0548-660b-42af-9af1-a762aaa6bb84 is loaded       │ PASS   │        360ns │
│ island_browser │                        │ asset     │ search island_browser-dc4eff97-2d93-4db7-b1c6-2e6e38699949 is loaded       │ PASS   │        382ns │
│ island_browser │ compromised_credential │ asset     │ index_template logs-island_browser.compromised_credential is loaded        │ PASS   │        394ns │
│ island_browser │ compromised_credential │ asset     │ ingest_pipeline logs-island_browser.compromised_credential-0.3.0 is loaded │ PASS   │        161ns │
│ island_browser │ device                 │ asset     │ index_template logs-island_browser.device is loaded                        │ PASS   │        476ns │
│ island_browser │ device                 │ asset     │ ingest_pipeline logs-island_browser.device-0.3.0 is loaded                 │ PASS   │        200ns │
│ island_browser │ user                   │ asset     │ index_template logs-island_browser.user is loaded                          │ PASS   │        348ns │
│ island_browser │ user                   │ asset     │ ingest_pipeline logs-island_browser.user-0.3.0 is loaded                   │ PASS   │        182ns │
╰────────────────┴────────────────────────┴───────────┴────────────────────────────────────────────────────────────────────────────┴────────┴──────────────╯
--- Test results for package: island_browser - END   ---
Done
Run pipeline tests for the package
--- Test results for package: island_browser - START ---
╭────────────────┬────────────────────────┬───────────┬────────────────────────────────────────────────────────────┬────────┬──────────────╮
│ PACKAGE        │ DATA STREAM            │ TEST TYPE │ TEST NAME                                                  │ RESULT │ TIME ELAPSED │
├────────────────┼────────────────────────┼───────────┼────────────────────────────────────────────────────────────┼────────┼──────────────┤
│ island_browser │ compromised_credential │ pipeline  │ (ingest pipeline warnings test-compromised-credential.log) │ PASS   │ 363.221533ms │
│ island_browser │ compromised_credential │ pipeline  │ test-compromised-credential.log                            │ PASS   │ 179.514301ms │
│ island_browser │ device                 │ pipeline  │ (ingest pipeline warnings test-device.log)                 │ PASS   │ 383.625087ms │
│ island_browser │ device                 │ pipeline  │ test-device.log                                            │ PASS   │ 340.670461ms │
│ island_browser │ user                   │ pipeline  │ (ingest pipeline warnings test-user.log)                   │ PASS   │ 369.605326ms │
│ island_browser │ user                   │ pipeline  │ test-user.log                                              │ PASS   │ 195.183394ms │
╰────────────────┴────────────────────────┴───────────┴────────────────────────────────────────────────────────────┴────────┴──────────────╯
--- Test results for package: island_browser - END   ---
Done
Run policy tests for the package
--- Test results for package: island_browser - START ---
No test results
--- Test results for package: island_browser - END   ---
Done
Run static tests for the package
--- Test results for package: island_browser - START ---
╭────────────────┬────────────────────────┬───────────┬──────────────────────────┬────────┬──────────────╮
│ PACKAGE        │ DATA STREAM            │ TEST TYPE │ TEST NAME                │ RESULT │ TIME ELAPSED │
├────────────────┼────────────────────────┼───────────┼──────────────────────────┼────────┼──────────────┤
│ island_browser │ compromised_credential │ static    │ Verify sample_event.json │ PASS   │ 112.850519ms │
│ island_browser │ device                 │ static    │ Verify sample_event.json │ PASS   │ 136.543042ms │
│ island_browser │ user                   │ static    │ Verify sample_event.json │ PASS   │ 121.099786ms │
╰────────────────┴────────────────────────┴───────────┴──────────────────────────┴────────┴──────────────╯
--- Test results for package: island_browser - END   ---
Done
Run system tests for the package
2025/09/17 18:42:50  INFO Installing package...
2025/09/17 18:43:03  INFO Running test for data_stream "compromised_credential" with configuration 'default'
2025/09/17 18:43:12  INFO Setting up independent Elastic Agent...
2025/09/17 18:43:20  INFO Setting up service...
2025/09/17 18:43:44  INFO Tearing down service...
2025/09/17 18:43:45  INFO Write container logs to file: /home/devuser/bitbucket/integrations/build/container-logs/island_browser-1758114825020732482.log
2025/09/17 18:43:46  INFO Tearing down agent...
2025/09/17 18:43:47  INFO Write container logs to file: /home/devuser/bitbucket/integrations/build/container-logs/elastic-agent-1758114827252767988.log
2025/09/17 18:43:55  INFO Running test for data_stream "device" with configuration 'default'
2025/09/17 18:44:03  INFO Setting up independent Elastic Agent...
2025/09/17 18:44:11  INFO Setting up service...
2025/09/17 18:44:32  INFO Tearing down service...
2025/09/17 18:44:33  INFO Write container logs to file: /home/devuser/bitbucket/integrations/build/container-logs/island_browser-1758114873257071346.log
2025/09/17 18:44:35  INFO Tearing down agent...
2025/09/17 18:44:35  INFO Write container logs to file: /home/devuser/bitbucket/integrations/build/container-logs/elastic-agent-1758114875284533047.log
2025/09/17 18:44:43  INFO Running test for data_stream "user" with configuration 'default'
2025/09/17 18:44:51  INFO Setting up independent Elastic Agent...
2025/09/17 18:45:00  INFO Setting up service...
2025/09/17 18:45:21  INFO Tearing down service...
2025/09/17 18:45:22  INFO Write container logs to file: /home/devuser/bitbucket/integrations/build/container-logs/island_browser-1758114922089027257.log
2025/09/17 18:45:24  INFO Tearing down agent...
2025/09/17 18:45:24  INFO Write container logs to file: /home/devuser/bitbucket/integrations/build/container-logs/elastic-agent-1758114924288254984.log
2025/09/17 18:45:32  INFO Uninstalling package...
--- Test results for package: island_browser - START ---
╭────────────────┬────────────────────────┬───────────┬───────────┬────────┬───────────────╮
│ PACKAGE        │ DATA STREAM            │ TEST TYPE │ TEST NAME │ RESULT │  TIME ELAPSED │
├────────────────┼────────────────────────┼───────────┼───────────┼────────┼───────────────┤
│ island_browser │ compromised_credential │ system    │ default   │ PASS   │ 40.367502635s │
│ island_browser │ device                 │ system    │ default   │ PASS   │ 36.852663444s │
│ island_browser │ user                   │ system    │ default   │ PASS   │ 37.664424353s │
╰────────────────┴────────────────────────┴───────────┴───────────┴────────┴───────────────╯
--- Test results for package: island_browser - END   ---
Done

Related issues

Relates [New Integration] Island Browser #14494

Screenshot

elastic-vault-github-plugin-prod · 2025-09-17T13:54:49Z

🚀 Benchmarks report

To see the full report comment with /test benchmark fullreport

elasticmachine · 2025-09-17T14:44:47Z

Pinging @elastic/security-service-integrations (Team:Security-Service Integrations)

efd6 · 2025-09-22T03:52:02Z

packages/island_browser/_dev/build/docs/README.md

 ### How it works

-This integration periodically queries the Island Browser API to retrieve details for devices and users, and audit events.
+This integration periodically queries the Island Browser API to retrieve details for devices, users and compromised credentials, and audit events.


Suggested change

This integration periodically queries the Island Browser API to retrieve details for devices, users and compromised credentials, and audit events.

This integration periodically queries the Island Browser API to retrieve details for devices, users and compromised credentials, and to log audit events.

We're stretching the possible cognitive suspension here (as noted in the previous review, it was already tenuous), adding the second infinitive here relaxes that so that it doesn't seem wrong now. It's still correct either way, but this reads better IMO.

elastic-sonarqube · 2025-09-24T07:54:53Z

Quality Gate passed

Issues
0 New issues
0 Fixed issues
0 Accepted issues

Measures
0 Security Hotspots
89.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube

…treams

elasticmachine · 2025-10-08T07:15:10Z

💚 Build Succeeded

Buildkite Build
Commit: 8340a40

History

💚 Build #31901 succeeded e8b87ec
💚 Build #31769 succeeded a73040e
💚 Build #31703 succeeded ad1cfd2
💚 Build #31555 succeeded 31c8141

elastic-vault-github-plugin-prod · 2025-10-08T20:30:52Z

Package island_browser - 0.4.0 containing this change is available at https://epr.elastic.co/package/island_browser/0.4.0/

…ed credential datastream (elastic#15372) The release includes compromised credential data stream, associated dashboards and visualizations. Island Browser fields are mapped to their corresponding ECS fields where possible. Test samples were derived from documentation.

Add compromised credential data stream

91b8867

janvi-elastic requested a review from a team as a code owner September 17, 2025 13:16

Update changelog

31c8141

Resolved merge conflicts

ad1cfd2

efd6 reviewed Sep 22, 2025

View reviewed changes

Resolved review comments

a73040e

janvi-elastic requested a review from efd6 September 22, 2025 08:25

Update kibana version

e8b87ec

janvi-elastic marked this pull request as draft September 24, 2025 07:24

Resolve merge conflicts and add ILM policy for user and device data s…

8340a40

…treams

janvi-elastic marked this pull request as ready for review October 8, 2025 07:24

efd6 approved these changes Oct 8, 2025

View reviewed changes

efd6 merged commit 51fe49d into elastic:main Oct 8, 2025
8 checks passed

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

[island_browser][compromised_credential] Add island_browser compromised credential datastream #15372

[island_browser][compromised_credential] Add island_browser compromised credential datastream #15372

Uh oh!

janvi-elastic commented Sep 17, 2025

Uh oh!

elastic-vault-github-plugin-prod bot commented Sep 17, 2025 •

edited

Loading

Uh oh!

elasticmachine commented Sep 17, 2025

Uh oh!

efd6 Sep 22, 2025

Uh oh!

elastic-sonarqube bot commented Sep 24, 2025

Uh oh!

elasticmachine commented Oct 8, 2025

Uh oh!

Uh oh!

elastic-vault-github-plugin-prod bot commented Oct 8, 2025

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

4 participants

	This integration periodically queries the Island Browser API to retrieve details for devices, users and compromised credentials, and audit events.
	This integration periodically queries the Island Browser API to retrieve details for devices, users and compromised credentials, and to log audit events.

[island_browser][compromised_credential] Add island_browser compromised credential datastream #15372

[island_browser][compromised_credential] Add island_browser compromised credential datastream #15372

Uh oh!

Conversation

janvi-elastic commented Sep 17, 2025

Proposed commit message

Checklist

How to test this PR locally

Related issues

Screenshot

Uh oh!

elastic-vault-github-plugin-prod bot commented Sep 17, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

🚀 Benchmarks report

Uh oh!

elasticmachine commented Sep 17, 2025

Uh oh!

efd6 Sep 22, 2025

Choose a reason for hiding this comment

Uh oh!

elastic-sonarqube bot commented Sep 24, 2025

Quality Gate passed

Uh oh!

elasticmachine commented Oct 8, 2025

💚 Build Succeeded

History

Uh oh!

Uh oh!

elastic-vault-github-plugin-prod bot commented Oct 8, 2025

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

4 participants

elastic-vault-github-plugin-prod bot commented Sep 17, 2025 •

edited

Loading