[New Integrationi] Anduril Lattice by tehbooom · Pull Request #20021 · elastic/integrations

tehbooom · 2026-07-07T18:54:28Z

Proposed commit message

Adds a new integration for the Anduril Lattice Common Operational Picture API. Collects entity lifecycle events (tracks, assets, geospatial zones, signals) via long-poll REST API with OAuth2 and static bearer token auth.

Checklist

I have reviewed tips for building integrations and this pull request is aligned with them.
I have verified that all data streams collect metrics or logs.
I have added an entry to my package's changelog.yml file.
I have verified that Kibana version constraints are current according to guidelines.
I have verified that any added dashboard complies with Kibana's Dashboard good practices

Author's Checklist

Verified working with Lattice Sandbox environment

How to test this PR locally

Need a developer account with Anduril to test

Screenshots

github-actions · 2026-07-07T18:56:19Z

Elastic Docs Style Checker (Vale)

Summary: 1 warning found

⚠️ Warnings (1): Fix when the suggestion improves clarity or correctness.

File	Line	Rule	Message
packages/anduril_lattice/data_stream/entity/fields/fields.yml	572	Elastic.Latinisms	Latin terms and abbreviations are a common source of confusion. Use 'for example' instead of 'e.g'.

The Vale linter checks documentation changes against the Elastic Docs style guide. To use Vale locally or report issues, refer to Elastic style guide for Vale.

github-actions · 2026-07-07T19:44:57Z

TL;DR

Buildkite build 45655 failed the Check integrations anduril_lattice package step on commit ef2deab, but the PR has since advanced to b7ec98. The follow-up commit removes controlGroupJson from the Anduril Lattice saved search object, so rerun CI on the current head before changing anything else.

Remediation

Keep commit b7ec98a52e9a61116d1953218af7cb0ca2483198's removal of controlGroupJson from packages/anduril_lattice/kibana/search/anduril_lattice-75f003ff-aed4-4e6b-83b0-21583fcefaa3.json.
Rerun the Check integrations anduril_lattice Buildkite step on the current PR head.
If it still fails, inspect/upload the full package-check log or test-result XML; the prefetched log for this run only includes teardown and the final exit status.

Investigation details

Root Cause

The actionable failure line is missing from the available Buildkite log, but the failed build is stale relative to the current PR head:

Failed build 45655 ran .buildkite/scripts/test_one_package.sh packages/anduril_lattice origin/main ef2deab2958fa89cae87e24dc6eb8305f296280c.
The PR now includes b7ec98a52e9a61116d1953218af7cb0ca2483198 (fix: Remove controlGroupJson) after that failed commit.
At failed commit ef2deab, the saved search object had unsupported-looking controlGroupJson attributes at packages/anduril_lattice/kibana/search/anduril_lattice-75f003ff-aed4-4e6b-83b0-21583fcefaa3.json:13 and :55.
The current PR head removes both fields, and a repository-wide search of existing package saved searches found no other controlGroupJson usage under packages/**/kibana/search/*.json.

Evidence

Build: https://buildkite.com/elastic/integrations/builds/45655
Job/step: Check integrations anduril_lattice
Failed command: .buildkite/scripts/test_one_package.sh packages/anduril_lattice origin/main ef2deab2958fa89cae87e24dc6eb8305f296280c
Post-failure fix commit: b7ec98a52e9a61116d1953218af7cb0ca2483198
Key log excerpt from /tmp/gh-aw/buildkite-logs/integrations-check-integrations-anduril_lattice.txt:95-100:

--- [anduril_lattice] failed
^^^ +++
🚨 Error: The command exited with status 1
^^^ +++
user command error: exit status 1

Verification

Not run locally: the local checkout is not on the PR branch, and this package check requires the CI Elastic stack/Docker path while this environment notes Docker-in-Docker is unsupported.
Verified with PR commit metadata that b7ec98 was pushed after the failed ef2deab build, and confirmed the exact saved-object diff removes only the two controlGroupJson attributes.

Follow-up

If Buildkite still fails on b7ec98, the next investigation needs the full elastic-package failure output or uploaded test-result XML because the prefetched job log does not include the package validation error itself.

What is this? | From workflow: PR Buildkite Detective

Give us feedback! React with 🚀 if perfect, 👍 if helpful, 👎 if not.

elastic-vault-github-plugin-prod · 2026-07-08T18:04:31Z

🚀 Benchmarks report

To see the full report comment with /test benchmark fullreport

teresaromero

for Vale linting fixes you van use the skill on this repository for the agents to update the readmes according to the elastic Vale style

teresaromero · 2026-07-09T08:04:56Z

+resource.timeout: {{http_client_timeout}}
+{{/if}}
+resource.url: {{url}}
+state:


The manifest/README claim OAuth2 tokens are auto-refreshed with a 30-minute lifetime, but the program never actually caches one: the state.?client_id check on line 29 only picks the auth mode (OAuth2 vs. static token), and the fetched auth.token is never written back into state (the state.with(...) returns on lines 56/69 only set events/cursor/want_more). So every poll re-authenticates from scratch — at the default 5s interval, ~720 token exchanges/hour instead of one per 30 minutes.

Per the Filebeat CEL input docs (https://www.elastic.co/guide/en/beats/filebeat/current/filebeat-input-cel.html), plain state fields persist across poll intervals for the life of the input, so caching is safe here. packages/cyera/data_stream/datastore/agent/stream/cel.yml.hbs (https://github.com/elastic/integrations/blob/main/packages/cyera/data_stream/datastore/agent/stream/cel.yml.hbs) already does this via has(state.?next.expiry) && timestamp(state.next.expiry) > now, reusing state.next.access_token when still valid. Worth the same pattern here.

…thentication

efd6 · 2026-07-09T23:51:17Z

+    - sandbox_token
+program: |-
+  state.with(
+    (state.?client_id.orValue("") != "") ?


Suggested change

(state.?client_id.orValue("") != "") ?

has(state.client_id) ?

efd6 · 2026-07-09T23:55:59Z

+          request(
+            "POST",
+            state.url.trim_right("/") + "/api/v1/oauth/token"
+          ).with(
+            {
+              "Header": {"Content-Type": ["application/json"]},
+              "Body": {
+                "client_id": state.client_id,
+                "client_secret": state.client_secret,
+              }.encode_json(),
+            }
+          ).do_request().as(tok_resp,


Suggested change

request(

"POST",

state.url.trim_right("/") + "/api/v1/oauth/token"

).with(

{

"Header": {"Content-Type": ["application/json"]},

"Body": {

"client_id": state.client_id,

"client_secret": state.client_secret,

}.encode_json(),

}

).do_request().as(tok_resp,

post_request(

state.url.trim_right("/") + "/api/v1/oauth/token",

"application/json",

{

"client_id": state.client_id,

"client_secret": state.client_secret,

}.encode_json()

).do_request().as(tok_resp,

efd6 · 2026-07-09T23:57:41Z

+            (tok_resp.StatusCode == 200) ?
+              tok_resp.Body.decode_json().as(tok_body,
+                {
+                  "token": string(tok_body.access_token),


Suggested change

"token": string(tok_body.access_token),

"token": tok_body.access_token,

But why is this being kept twice?

efd6 · 2026-07-09T23:57:55Z

+          )
+      )
+    :
+      {"token": state.?token.orValue("")}


Suggested change

{"token": state.?token.orValue("")}

{?"token": state.?token}

efd6 · 2026-07-10T00:03:24Z

+        request(
+          "POST",
+          state.url.trim_right("/") + "/api/v1/entities/events"
+        ).with(
+          {
+            "Header": {
+              "Content-Type": ["application/json"],
+              ?"Authorization": (state.token != "") ?
+                optional.of(["Bearer " + state.token])
+              :
+                optional.none(),
+              ?"Anduril-Sandbox-Authorization": (state.?sandbox_token.orValue("") != "") ?
+                optional.of(["Bearer " + state.sandbox_token])
+              :
+                optional.none(),
+            },
+            "Body": {
+              "sessionToken": state.?cursor.session_token.orValue(""),
+              "batchSize": int(state.batch_size),
+            }.encode_json(),
+          }
+        ).do_request().as(resp,


Suggested change

request(

"POST",

state.url.trim_right("/") + "/api/v1/entities/events"

).with(

{

"Header": {

"Content-Type": ["application/json"],

?"Authorization": (state.token != "") ?

optional.of(["Bearer " + state.token])

:

optional.none(),

?"Anduril-Sandbox-Authorization": (state.?sandbox_token.orValue("") != "") ?

optional.of(["Bearer " + state.sandbox_token])

:

optional.none(),

},

"Body": {

"sessionToken": state.?cursor.session_token.orValue(""),

"batchSize": int(state.batch_size),

}.encode_json(),

}

).do_request().as(resp,

request(

"POST",

state.url.trim_right("/") + "/api/v1/entities/events",

{

?"sessionToken": state.?cursor.session_token,

"batchSize": int(state.batch_size),

}.encode_json()

).with(

{

"Header": {

"Content-Type": ["application/json"],

?"Authorization": state.token.optMap(t, ["Bearer " + t]),

?"Anduril-Sandbox-Authorization": state.?sandbox_token.optMap(t, ["Bearer " + t]),.orValue("") != ""),

}

).do_request().as(resp,

efd6 · 2026-07-10T00:06:23Z

+                        "version": 2,
+                        "visualizationType": "lnsXY"
+                    },
+                    "title": "Diposition Distribution"


Suggested change

"title": "Diposition Distribution"

"title": "Disposition Distribution"

efd6 · 2026-07-10T00:07:35Z

+                                    "layers": {}
+                                }
+                            },
+                            "filters": [],


This should have a filter to restrict it to the data stream.

efd6 · 2026-07-10T00:09:10Z

+                            },
+                            "zoom": 3.08
+                        },
+                        "title": "[Anduril Lattice] Entity Map",


Suggested change

"title": "[Anduril Lattice] Entity Map",

"title": "Entity Map",

Already in the dashboard.

efd6 · 2026-07-10T00:09:29Z

Add titles to the metrics panels.

Add layer-level queries to the maps so that if the map query is cleared we don't get all logs-*.

efd6 · 2026-07-10T00:11:01Z

We don't need this; it will be injected.

elastic-vault-github-plugin-prod · 2026-07-10T20:00:26Z

✅ All changelog entries have the correct PR link.

infra-vault-gh-plugin-prod · 2026-07-10T20:14:48Z

💚 Build Succeeded

Buildkite Build
Commit: 0dc5925

History

💔 Build #45820 failed 5cd1b6b
💚 Build #45749 succeeded 5207e5a
💔 Build #45671 failed 95a88e5
💔 Build #45660 failed bc098ff
💔 Build #45657 failed b7ec98a

initial commit

63bbcf9

tehbooom requested a review from a team as a code owner July 7, 2026 18:54

chore: Update PR link

ae40023

fix: Decrease version for kb

ef2deab

This comment has been minimized.

Sign in to view

fix: Remove controlGroupJson

b7ec98a

andrewkroh added New Integration Issue or pull request for creating a new integration package. documentation Improvements or additions to documentation. Applied to PRs that modify *.md files. labels Jul 7, 2026

tehbooom added 3 commits July 7, 2026 16:09

fix: Saved search

bc098ff

bump version

95a88e5

fix: removed saved search

5207e5a

teresaromero reviewed Jul 9, 2026

View reviewed changes

tehbooom added 6 commits July 9, 2026 11:29

fix: Rename dashboard images and remove saved search screenshot

2231ea0

fix: elastic-package format

2501699

fix: vale linting

d348410

chore: Bump ecs to 9.4.0

4a491bc

fix: cache OAuth2 token across poll intervals to avoid per-poll re-au…

0035ebc

…thentication

fix: Rebuild docs

5cd1b6b

efd6 reviewed Jul 10, 2026

View reviewed changes

fix: All comments from review

0dc5925

	(state.?client_id.orValue("") != "") ?
	has(state.client_id) ?

	"token": string(tok_body.access_token),
	"token": tok_body.access_token,

	"title": "Diposition Distribution"
	"title": "Disposition Distribution"

	"title": "[Anduril Lattice] Entity Map",
	"title": "Entity Map",

Uh oh!

Conversation

tehbooom commented Jul 7, 2026

Proposed commit message

Checklist

Author's Checklist

How to test this PR locally

Screenshots

Uh oh!

github-actions Bot commented Jul 7, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Elastic Docs Style Checker (Vale)

Uh oh!

This comment has been minimized.

github-actions Bot commented Jul 7, 2026

TL;DR

Remediation

Root Cause

Evidence

Verification

Follow-up

Uh oh!

elastic-vault-github-plugin-prod Bot commented Jul 8, 2026

🚀 Benchmarks report

Uh oh!

teresaromero left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

elastic-vault-github-plugin-prod Bot commented Jul 10, 2026

Uh oh!

infra-vault-gh-plugin-prod Bot commented Jul 10, 2026

💚 Build Succeeded

History

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

4 participants

github-actions Bot commented Jul 7, 2026 •

edited

Loading