[BeyondTrust EPM][Audit] Add Audit data stream

[akshraj-crest]

Proposed commit message

The initial release includes audit data stream, associated dashboard
and visualizations.

BeyondTrust EPM fields are mapped to their corresponding ECS fields where possible.

Test samples were derived from live data samples, which were subsequently
sanitized.

Checklist

• I have reviewed tips for building integrations and this pull request is aligned with them.
• I have verified that all data streams collect metrics or logs.
• I have added an entry to my package's changelog.yml file.
• I have verified that Kibana version constraints are current according to guidelines.
• I have verified that any added dashboard complies with Kibana's Dashboard good practices

How to test this PR locally

To test the BeyondTrust EPM package:

• Clone integrations repo.
• Install elastic package locally.
• Start elastic stack using elastic-package.
• Move to integrations/packages/beyondtrust_epm directory.
• Run the following command to run tests.

elastic-package test

Run asset tests for the package
2026/04/24 17:25:32  INFO elastic-package v0.122.0 version-hash 0d1afec6 (build time: 2026-03-31T23:02:11+05:30)
2026/04/24 17:25:32  INFO elastic-stack: 8.18.0
--- Test results for package: beyondtrust_epm - START ---
╭─────────────────┬─────────────┬───────────┬──────────────────────────────────────────────────────────────────────────┬────────┬──────────────╮
│ PACKAGE         │ DATA STREAM │ TEST TYPE │ TEST NAME                                                                │ RESULT │ TIME ELAPSED │
├─────────────────┼─────────────┼───────────┼──────────────────────────────────────────────────────────────────────────┼────────┼──────────────┤
│ beyondtrust_epm │             │ asset     │ dashboard beyondtrust_epm-20f84912-15d7-4fa5-94eb-a2c945a6d477 is loaded │ PASS   │       1.23µs │
│ beyondtrust_epm │ audit       │ asset     │ index_template logs-beyondtrust_epm.audit is loaded                      │ PASS   │        326ns │
│ beyondtrust_epm │ audit       │ asset     │ ingest_pipeline logs-beyondtrust_epm.audit-0.1.0 is loaded               │ PASS   │        108ns │
╰─────────────────┴─────────────┴───────────┴──────────────────────────────────────────────────────────────────────────┴────────┴──────────────╯
--- Test results for package: beyondtrust_epm - END   ---
Done
Run pipeline tests for the package
2026/04/24 17:25:37  INFO elastic-package v0.122.0 version-hash 0d1afec6 (build time: 2026-03-31T23:02:11+05:30)
2026/04/24 17:25:37  INFO elastic-stack: 8.18.0
--- Test results for package: beyondtrust_epm - START ---
╭─────────────────┬─────────────┬───────────┬───────────────────────────────────────────┬────────┬──────────────╮
│ PACKAGE         │ DATA STREAM │ TEST TYPE │ TEST NAME                                 │ RESULT │ TIME ELAPSED │
├─────────────────┼─────────────┼───────────┼───────────────────────────────────────────┼────────┼──────────────┤
│ beyondtrust_epm │ audit       │ pipeline  │ (ingest pipeline warnings test-audit.log) │ PASS   │ 279.070633ms │
│ beyondtrust_epm │ audit       │ pipeline  │ test-audit.log                            │ PASS   │  235.23062ms │
╰─────────────────┴─────────────┴───────────┴───────────────────────────────────────────┴────────┴──────────────╯
--- Test results for package: beyondtrust_epm - END   ---
Done
Run policy tests for the package
2026/04/24 17:25:38  INFO elastic-package v0.122.0 version-hash 0d1afec6 (build time: 2026-03-31T23:02:11+05:30)
2026/04/24 17:25:38  INFO elastic-stack: 8.18.0
--- Test results for package: beyondtrust_epm - START ---
No test results
--- Test results for package: beyondtrust_epm - END   ---
Done
Run script tests for the package
PKG beyondtrust_epm
[no test files]
--- Test results for package: beyondtrust_epm - START ---
No test results
--- Test results for package: beyondtrust_epm - END   ---
Done
Run static tests for the package
2026/04/24 17:25:38  INFO elastic-package v0.122.0 version-hash 0d1afec6 (build time: 2026-03-31T23:02:11+05:30)
--- Test results for package: beyondtrust_epm - START ---
╭─────────────────┬─────────────┬───────────┬──────────────────────────┬────────┬──────────────╮
│ PACKAGE         │ DATA STREAM │ TEST TYPE │ TEST NAME                │ RESULT │ TIME ELAPSED │
├─────────────────┼─────────────┼───────────┼──────────────────────────┼────────┼──────────────┤
│ beyondtrust_epm │ audit       │ static    │ Verify sample_event.json │ PASS   │ 124.855728ms │
╰─────────────────┴─────────────┴───────────┴──────────────────────────┴────────┴──────────────╯
--- Test results for package: beyondtrust_epm - END   ---
Done
Run system tests for the package
2026/04/24 17:25:38  INFO elastic-package v0.122.0 version-hash 0d1afec6 (build time: 2026-03-31T23:02:11+05:30)
2026/04/24 17:25:38  INFO elastic-stack: 8.18.0
2026/04/24 17:25:38  INFO Installing package...
2026/04/24 17:25:50  INFO Running test for data_stream "audit" with configuration 'cel'
2026/04/24 17:26:00  INFO Setting up independent Elastic Agent...
2026/04/24 17:26:07  INFO Setting up service...
2026/04/24 17:26:29  INFO Validating test case...
2026/04/24 17:26:30  INFO Tearing down service...
2026/04/24 17:26:30  INFO Write container logs to file: /root/integrations/build/container-logs/beyondtrust_epm-1777031790812298170.log
2026/04/24 17:26:32  INFO Tearing down agent...
2026/04/24 17:26:32  INFO Write container logs to file: /root/integrations/build/container-logs/elastic-agent-1777031792597731461.log
2026/04/24 17:26:40  INFO Running test for data_stream "audit" with configuration 'aws'
2026/04/24 17:26:49  INFO Setting up independent Elastic Agent...
2026/04/24 17:26:57  INFO Setting up service...
2026/04/24 17:30:26  INFO Validating test case...
2026/04/24 17:30:27  INFO Tearing down service...
2026/04/24 17:33:18  INFO Write container logs to file: /root/integrations/build/container-logs/beyondtrust_epm-1777032198731825610.log
2026/04/24 17:33:20  INFO Tearing down agent...
2026/04/24 17:33:20  INFO Write container logs to file: /root/integrations/build/container-logs/elastic-agent-1777032200682549123.log
2026/04/24 17:33:28  INFO Uninstalling package...
--- Test results for package: beyondtrust_epm - START ---
╭─────────────────┬─────────────┬───────────┬───────────┬────────┬─────────────────╮
│ PACKAGE         │ DATA STREAM │ TEST TYPE │ TEST NAME │ RESULT │    TIME ELAPSED │
├─────────────────┼─────────────┼───────────┼───────────┼────────┼─────────────────┤
│ beyondtrust_epm │ audit       │ system    │ aws       │ PASS   │ 3m46.626307533s │
│ beyondtrust_epm │ audit       │ system    │ cel       │ PASS   │   39.609447875s │
╰─────────────────┴─────────────┴───────────┴───────────┴────────┴─────────────────╯
--- Test results for package: beyondtrust_epm - END   ---
Done

Related issues

• Relates: [New Integration] BeyondTrust EPM #18166

Screenshots

Implementation Details

API Documentation: https://docs.beyondtrust.com/epm-wm/v25.1/reference/get_v3-activityaudits-details

Default Config Values:

• initial_interval: 24h
• interval: 5m
• page_size: 200

[elastic-vault-github-plugin-prod]

Reviewers

Buildkite won't run for external contributors automatically; you need to add a comment:

• /test : will kick off a build in Buildkite.

NOTE: https://github.com/elastic/integrations/blob/main/.buildkite/pull-requests.json contains all those details.

[efd6]

Thanks

[elastic-vault-github-plugin-prod]

Package beyondtrust_epm - 0.1.0 containing this change is available at https://epr.elastic.co/package/beyondtrust_epm/0.1.0/