[New Integrationi] Anduril Lattice

[tehbooom]

Proposed commit message

Adds a new integration for the Anduril Lattice Common Operational Picture API. Collects entity lifecycle events (tracks, assets, geospatial zones, signals) via long-poll REST API with OAuth2 and static bearer token auth.

Checklist

• I have reviewed tips for building integrations and this pull request is aligned with them.
• I have verified that all data streams collect metrics or logs.
• I have added an entry to my package's changelog.yml file.
• I have verified that Kibana version constraints are current according to guidelines.
• I have verified that any added dashboard complies with Kibana's Dashboard good practices

Author's Checklist

• Verified working with Lattice Sandbox environment

How to test this PR locally

Need a developer account with Anduril to test

Screenshots

[github-actions]

Elastic Docs Style Checker (Vale)

Summary: 13 warnings, 2 suggestions found

⚠️ Warnings (13): Fix when the suggestion improves clarity or correctness.

File	Line	Rule	Message
packages/anduril_lattice/_dev/build/docs/README.md	56	Elastic.Latinisms	Latin terms and abbreviations are a common source of confusion. Use 'for example' instead of 'e.g'.
packages/anduril_lattice/_dev/build/docs/README.md	69	Elastic.MenuArrowsBold	Use '→' to separate menu items, not '' or '='. Example: Select Manage index → Add lifecycle policy.
packages/anduril_lattice/_dev/build/docs/README.md	81	Elastic.MenuArrowsBold	Use '→' to separate menu items, not '' or '='. Example: Select Manage index → Add lifecycle policy.
packages/anduril_lattice/data_stream/entity/fields/fields.yml	220	Elastic.Latinisms	Latin terms and abbreviations are a common source of confusion. Use 'for example' instead of 'e.g'.
packages/anduril_lattice/data_stream/entity/fields/fields.yml	220	Elastic.QuotesPunctuation	Place punctuation inside closing quotation marks.
packages/anduril_lattice/data_stream/entity/fields/fields.yml	422	Elastic.Latinisms	Latin terms and abbreviations are a common source of confusion. Use 'for example' instead of 'e.g'.
packages/anduril_lattice/data_stream/entity/fields/fields.yml	539	Elastic.Latinisms	Latin terms and abbreviations are a common source of confusion. Use 'for example' instead of 'e.g'.
packages/anduril_lattice/data_stream/entity/fields/fields.yml	556	Elastic.Latinisms	Latin terms and abbreviations are a common source of confusion. Use 'for example' instead of 'e.g'.
packages/anduril_lattice/data_stream/entity/fields/fields.yml	572	Elastic.Latinisms	Latin terms and abbreviations are a common source of confusion. Use 'for example' instead of 'e.g'.
packages/anduril_lattice/data_stream/entity/fields/fields.yml	653	Elastic.Latinisms	Latin terms and abbreviations are a common source of confusion. Use 'for example' instead of 'e.g'.
packages/anduril_lattice/data_stream/entity/fields/fields.yml	653	Elastic.QuotesPunctuation	Place punctuation inside closing quotation marks.
packages/anduril_lattice/data_stream/entity/manifest.yml	45	Elastic.Latinisms	Latin terms and abbreviations are a common source of confusion. Use 'and so on' instead of 'etc'.
packages/anduril_lattice/manifest.yml	48	Elastic.Latinisms	Latin terms and abbreviations are a common source of confusion. Use 'for example' instead of 'e.g'.

💡 Suggestions (2): Optional style improvements. Apply when helpful.

File	Line	Rule	Message
packages/anduril_lattice/_dev/build/docs/README.md	97	Elastic.WordChoice	Consider using 'can, might' instead of 'may', unless the term is in the UI.
packages/anduril_lattice/changelog.yml	1	Elastic.Versions	Use 'later versions' instead of 'newer versions' when referring to versions.

---

The Vale linter checks documentation changes against the Elastic Docs style guide. To use Vale locally or report issues, refer to Elastic style guide for Vale.

[github-actions]

TL;DR

Buildkite build 45655 failed the Check integrations anduril_lattice package step on commit ef2deab, but the PR has since advanced to b7ec98. The follow-up commit removes controlGroupJson from the Anduril Lattice saved search object, so rerun CI on the current head before changing anything else.

Remediation

• Keep commit b7ec98a52e9a61116d1953218af7cb0ca2483198's removal of controlGroupJson from packages/anduril_lattice/kibana/search/anduril_lattice-75f003ff-aed4-4e6b-83b0-21583fcefaa3.json.
• Rerun the Check integrations anduril_lattice Buildkite step on the current PR head.
• If it still fails, inspect/upload the full package-check log or test-result XML; the prefetched log for this run only includes teardown and the final exit status.

Investigation details

Root Cause

The actionable failure line is missing from the available Buildkite log, but the failed build is stale relative to the current PR head:

• Failed build 45655 ran .buildkite/scripts/test_one_package.sh packages/anduril_lattice origin/main ef2deab2958fa89cae87e24dc6eb8305f296280c.
• The PR now includes b7ec98a52e9a61116d1953218af7cb0ca2483198 (fix: Remove controlGroupJson) after that failed commit.
• At failed commit ef2deab, the saved search object had unsupported-looking controlGroupJson attributes at packages/anduril_lattice/kibana/search/anduril_lattice-75f003ff-aed4-4e6b-83b0-21583fcefaa3.json:13 and :55.
• The current PR head removes both fields, and a repository-wide search of existing package saved searches found no other controlGroupJson usage under packages/**/kibana/search/*.json.

Evidence

• Build: https://buildkite.com/elastic/integrations/builds/45655
• Job/step: Check integrations anduril_lattice
• Failed command: .buildkite/scripts/test_one_package.sh packages/anduril_lattice origin/main ef2deab2958fa89cae87e24dc6eb8305f296280c
• Post-failure fix commit: b7ec98a52e9a61116d1953218af7cb0ca2483198
• Key log excerpt from /tmp/gh-aw/buildkite-logs/integrations-check-integrations-anduril_lattice.txt:95-100:

--- [anduril_lattice] failed
^^^ +++
🚨 Error: The command exited with status 1
^^^ +++
user command error: exit status 1

Verification

• Not run locally: the local checkout is not on the PR branch, and this package check requires the CI Elastic stack/Docker path while this environment notes Docker-in-Docker is unsupported.
• Verified with PR commit metadata that b7ec98 was pushed after the failed ef2deab build, and confirmed the exact saved-object diff removes only the two controlGroupJson attributes.

Follow-up

If Buildkite still fails on b7ec98, the next investigation needs the full elastic-package failure output or uploaded test-result XML because the prefetched job log does not include the package validation error itself.

---

What is this? | From workflow: PR Buildkite Detective

Give us feedback! React with 🚀 if perfect, 👍 if helpful, 👎 if not.

[elastic-vault-github-plugin-prod]

✅ All changelog entries have the correct PR link.

[infra-vault-gh-plugin-prod]

💔 Build Failed

• Buildkite Build
• Commit: 95a88e5

Failed CI Steps

• Check integrations anduril_lattice

History

• 💔 Build #45660 failed bc098ff
• 💔 Build #45657 failed b7ec98a
• 💔 Build #45655 failed ef2deab
• 💔 Build #45654 failed ae40023