feat: first version of the HarfangLab integration

[Robert-HarfangLab]

Proposed commit message

Add a new HarfangLab EDR integration.

WHAT: The integration collects ECS-formatted security telemetry from the HarfangLab EDR agent through two input modes: http_endpoint (the agent pushes events) and cel (the integration polls the HarfangLab API). Events land in the harfanglab.generic data stream, where a routing rule reroutes anything with event.kind: alert to harfanglab.detection. Ships two data streams, three dashboards, a detection rule and two data views.

WHY: HarfangLab agents already emit ECS-formatted events, but there was no supported path to get them into Elasticsearch. Customers had to build custom ingest configurations per deployment. Supporting both push and pull covers the two network topologies the agent is deployed in.

Checklist

• I have reviewed tips for building integrations and this pull request is aligned with them.
• I have verified that all data streams collect metrics or logs.
• I have added an entry to my package's changelog.yml file.
• I have verified that Kibana version constraints are current according to guidelines.
• I have verified that any added dashboard complies with Kibana's Dashboard good practices

Author's Checklist

• Both input modes (http_endpoint and cel) tested against a live HarfangLab agent.
• Routing rule sends event.kind: alert to harfanglab.detection and nothing else.

How to test this PR locally

elastic-package stack up -d --version 9.0.0

Then cd packages/harfanglab && elastic-package check && elastic-package test. Install the package from Kibana's Integrations UI, configure an agent policy with the HTTP endpoint input, and send a sample event from data_stream/generic/sample_event.json to the listen address.

Related issues

• None

Screenshots

[cla-checker-service]

💚 CLA has been signed

[elastic-vault-github-plugin-prod]

Reviewers

Buildkite won't run for external contributors automatically; you need to add a comment:

• /test : will kick off a build in Buildkite.

NOTE: https://github.com/elastic/integrations/blob/main/.buildkite/pull-requests.json contains all those details.

[efd6]

Please add a system test.

[Robert-HarfangLab]

Hi @efd6, I added system test as requested.

Best regards