[New Integrationi] Anduril Lattice by tehbooom · Pull Request #20021 · elastic/integrations

tehbooom · 2026-07-07T18:54:28Z

Proposed commit message

Adds a new integration for the Anduril Lattice Common Operational Picture API. Collects entity lifecycle events (tracks, assets, geospatial zones, signals) via long-poll REST API with OAuth2 and static bearer token auth.

Checklist

I have reviewed tips for building integrations and this pull request is aligned with them.
I have verified that all data streams collect metrics or logs.
I have added an entry to my package's changelog.yml file.
I have verified that Kibana version constraints are current according to guidelines.
I have verified that any added dashboard complies with Kibana's Dashboard good practices

Author's Checklist

Verified working with Lattice Sandbox environment

How to test this PR locally

Need a developer account with Anduril to test

Screenshots

github-actions · 2026-07-07T18:56:19Z

Elastic Docs Style Checker (Vale)

Summary: 13 warnings, 2 suggestions found

⚠️ Warnings (13): Fix when the suggestion improves clarity or correctness.

File	Line	Rule	Message
packages/anduril_lattice/_dev/build/docs/README.md	56	Elastic.Latinisms	Latin terms and abbreviations are a common source of confusion. Use 'for example' instead of 'e.g'.
packages/anduril_lattice/_dev/build/docs/README.md	69	Elastic.MenuArrowsBold	Use '→' to separate menu items, not '' or '='. Example: Select Manage index → Add lifecycle policy.
packages/anduril_lattice/_dev/build/docs/README.md	81	Elastic.MenuArrowsBold	Use '→' to separate menu items, not '' or '='. Example: Select Manage index → Add lifecycle policy.
packages/anduril_lattice/data_stream/entity/fields/fields.yml	220	Elastic.Latinisms	Latin terms and abbreviations are a common source of confusion. Use 'for example' instead of 'e.g'.
packages/anduril_lattice/data_stream/entity/fields/fields.yml	220	Elastic.QuotesPunctuation	Place punctuation inside closing quotation marks.
packages/anduril_lattice/data_stream/entity/fields/fields.yml	422	Elastic.Latinisms	Latin terms and abbreviations are a common source of confusion. Use 'for example' instead of 'e.g'.
packages/anduril_lattice/data_stream/entity/fields/fields.yml	539	Elastic.Latinisms	Latin terms and abbreviations are a common source of confusion. Use 'for example' instead of 'e.g'.
packages/anduril_lattice/data_stream/entity/fields/fields.yml	556	Elastic.Latinisms	Latin terms and abbreviations are a common source of confusion. Use 'for example' instead of 'e.g'.
packages/anduril_lattice/data_stream/entity/fields/fields.yml	572	Elastic.Latinisms	Latin terms and abbreviations are a common source of confusion. Use 'for example' instead of 'e.g'.
packages/anduril_lattice/data_stream/entity/fields/fields.yml	653	Elastic.Latinisms	Latin terms and abbreviations are a common source of confusion. Use 'for example' instead of 'e.g'.
packages/anduril_lattice/data_stream/entity/fields/fields.yml	653	Elastic.QuotesPunctuation	Place punctuation inside closing quotation marks.
packages/anduril_lattice/data_stream/entity/manifest.yml	45	Elastic.Latinisms	Latin terms and abbreviations are a common source of confusion. Use 'and so on' instead of 'etc'.
packages/anduril_lattice/manifest.yml	48	Elastic.Latinisms	Latin terms and abbreviations are a common source of confusion. Use 'for example' instead of 'e.g'.

💡 Suggestions (2): Optional style improvements. Apply when helpful.

File	Line	Rule	Message
packages/anduril_lattice/_dev/build/docs/README.md	97	Elastic.WordChoice	Consider using 'can, might' instead of 'may', unless the term is in the UI.
packages/anduril_lattice/changelog.yml	1	Elastic.Versions	Use 'later versions' instead of 'newer versions' when referring to versions.

The Vale linter checks documentation changes against the Elastic Docs style guide. To use Vale locally or report issues, refer to Elastic style guide for Vale.

github-actions · 2026-07-07T19:44:57Z

TL;DR

Buildkite build 45655 failed the Check integrations anduril_lattice package step on commit ef2deab, but the PR has since advanced to b7ec98. The follow-up commit removes controlGroupJson from the Anduril Lattice saved search object, so rerun CI on the current head before changing anything else.

Remediation

Keep commit b7ec98a52e9a61116d1953218af7cb0ca2483198's removal of controlGroupJson from packages/anduril_lattice/kibana/search/anduril_lattice-75f003ff-aed4-4e6b-83b0-21583fcefaa3.json.
Rerun the Check integrations anduril_lattice Buildkite step on the current PR head.
If it still fails, inspect/upload the full package-check log or test-result XML; the prefetched log for this run only includes teardown and the final exit status.

Investigation details

Root Cause

The actionable failure line is missing from the available Buildkite log, but the failed build is stale relative to the current PR head:

Failed build 45655 ran .buildkite/scripts/test_one_package.sh packages/anduril_lattice origin/main ef2deab2958fa89cae87e24dc6eb8305f296280c.
The PR now includes b7ec98a52e9a61116d1953218af7cb0ca2483198 (fix: Remove controlGroupJson) after that failed commit.
At failed commit ef2deab, the saved search object had unsupported-looking controlGroupJson attributes at packages/anduril_lattice/kibana/search/anduril_lattice-75f003ff-aed4-4e6b-83b0-21583fcefaa3.json:13 and :55.
The current PR head removes both fields, and a repository-wide search of existing package saved searches found no other controlGroupJson usage under packages/**/kibana/search/*.json.

Evidence

Build: https://buildkite.com/elastic/integrations/builds/45655
Job/step: Check integrations anduril_lattice
Failed command: .buildkite/scripts/test_one_package.sh packages/anduril_lattice origin/main ef2deab2958fa89cae87e24dc6eb8305f296280c
Post-failure fix commit: b7ec98a52e9a61116d1953218af7cb0ca2483198
Key log excerpt from /tmp/gh-aw/buildkite-logs/integrations-check-integrations-anduril_lattice.txt:95-100:

--- [anduril_lattice] failed
^^^ +++
🚨 Error: The command exited with status 1
^^^ +++
user command error: exit status 1

Verification

Not run locally: the local checkout is not on the PR branch, and this package check requires the CI Elastic stack/Docker path while this environment notes Docker-in-Docker is unsupported.
Verified with PR commit metadata that b7ec98 was pushed after the failed ef2deab build, and confirmed the exact saved-object diff removes only the two controlGroupJson attributes.

Follow-up

If Buildkite still fails on b7ec98, the next investigation needs the full elastic-package failure output or uploaded test-result XML because the prefetched job log does not include the package validation error itself.

What is this? | From workflow: PR Buildkite Detective

Give us feedback! React with 🚀 if perfect, 👍 if helpful, 👎 if not.

elastic-vault-github-plugin-prod · 2026-07-08T17:45:43Z

✅ All changelog entries have the correct PR link.

elastic-vault-github-plugin-prod · 2026-07-08T18:04:31Z

🚀 Benchmarks report

To see the full report comment with /test benchmark fullreport

infra-vault-gh-plugin-prod · 2026-07-08T18:04:36Z

💚 Build Succeeded

Buildkite Build
Commit: 5207e5a

History

💔 Build #45671 failed 95a88e5
💔 Build #45660 failed bc098ff
💔 Build #45657 failed b7ec98a
💔 Build #45655 failed ef2deab
💔 Build #45654 failed ae40023

teresaromero

for Vale linting fixes you van use the skill on this repository for the agents to update the readmes according to the elastic Vale style

teresaromero · 2026-07-09T07:46:36Z

+  - src: /img/entity-dashboard-1.png
+    title: Sample screenshot
+    size: 600x600
+    type: image/png
+  - src: /img/entity-dashboard-2.png
+    title: Sample screenshot
+    size: 600x600
+    type: image/png
+  - src: /img/entity-dashboard-3.png
+    title: Sample screenshot
+    size: 600x600
+    type: image/png


nit: can we rename the titles to be aligned with the content of the screenshot?

teresaromero · 2026-07-09T07:48:13Z

the dashboard wasn't run through elastic-package format (differs from canonical indentation), and still carries a live accessControl.owner Kibana user ID from the export.

teresaromero · 2026-07-09T07:49:00Z

@@ -0,0 +1,3 @@
+dependencies:
+  ecs:
+    reference: "git@v9.3.0"


perhaps you could use 9.4.0

teresaromero · 2026-07-09T07:52:46Z

+  - set:
+      field: ecs.version
+      tag: set_ecs_version
+      value: '9.3.0'


if updating the ecs version, this should probably be updated too

teresaromero · 2026-07-09T08:04:56Z

+resource.timeout: {{http_client_timeout}}
+{{/if}}
+resource.url: {{url}}
+state:


The manifest/README claim OAuth2 tokens are auto-refreshed with a 30-minute lifetime, but the program never actually caches one: the state.?client_id check on line 29 only picks the auth mode (OAuth2 vs. static token), and the fetched auth.token is never written back into state (the state.with(...) returns on lines 56/69 only set events/cursor/want_more). So every poll re-authenticates from scratch — at the default 5s interval, ~720 token exchanges/hour instead of one per 30 minutes.

Per the Filebeat CEL input docs (https://www.elastic.co/guide/en/beats/filebeat/current/filebeat-input-cel.html), plain state fields persist across poll intervals for the life of the input, so caching is safe here. packages/cyera/data_stream/datastore/agent/stream/cel.yml.hbs (https://github.com/elastic/integrations/blob/main/packages/cyera/data_stream/datastore/agent/stream/cel.yml.hbs) already does this via has(state.?next.expiry) && timestamp(state.next.expiry) > now, reusing state.next.access_token when still valid. Worth the same pattern here.

initial commit

63bbcf9

tehbooom requested a review from a team as a code owner July 7, 2026 18:54

chore: Update PR link

ae40023

fix: Decrease version for kb

ef2deab

This comment has been minimized.

Sign in to view

fix: Remove controlGroupJson

b7ec98a

andrewkroh added New Integration Issue or pull request for creating a new integration package. documentation Improvements or additions to documentation. Applied to PRs that modify *.md files. labels Jul 7, 2026

tehbooom added 3 commits July 7, 2026 16:09

fix: Saved search

bc098ff

bump version

95a88e5

fix: removed saved search

5207e5a

teresaromero reviewed Jul 9, 2026

View reviewed changes

Uh oh!

Conversation

tehbooom commented Jul 7, 2026

Proposed commit message

Checklist

Author's Checklist

How to test this PR locally

Screenshots

Uh oh!

github-actions Bot commented Jul 7, 2026

Elastic Docs Style Checker (Vale)

Uh oh!

This comment has been minimized.

github-actions Bot commented Jul 7, 2026

TL;DR

Remediation

Root Cause

Evidence

Verification

Follow-up

Uh oh!

elastic-vault-github-plugin-prod Bot commented Jul 8, 2026

Uh oh!

elastic-vault-github-plugin-prod Bot commented Jul 8, 2026

🚀 Benchmarks report

Uh oh!

infra-vault-gh-plugin-prod Bot commented Jul 8, 2026

💚 Build Succeeded

History

Uh oh!

teresaromero left a comment

Choose a reason for hiding this comment

Uh oh!

teresaromero Jul 9, 2026

Choose a reason for hiding this comment

Uh oh!

teresaromero Jul 9, 2026

Choose a reason for hiding this comment

Uh oh!

teresaromero Jul 9, 2026

Choose a reason for hiding this comment

Uh oh!

teresaromero Jul 9, 2026

Choose a reason for hiding this comment

Uh oh!

teresaromero Jul 9, 2026

Choose a reason for hiding this comment

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants