[Faitour Honeypot] Initial Push of Beta Integration #15889

MakoWish · 2025-11-06T20:35:22Z

Type of change

Enhancement

Proposed commit message

This is an initial push for a new Integration Faitour: MakoWish/Faitour

Checklist

I have reviewed tips for building integrations and this pull request is aligned with them.
I have verified that all data streams collect metrics or logs.
I have added an entry to my package's changelog.yml file.
I have verified that Kibana version constraints are current according to guidelines.
I have verified that any added dashboard complies with Kibana's Dashboard good practices

Author's Checklist

Separate application logging from honeypot event logging for distinct datasets
Dashboards will be created once the beta is released and available

Notes

See #13304 for additional conversation on this one. I needed to refactor the logging into two different file sets for distinct datasets in Elastic, and I finally found the time to get that done.

Commit suggested changes to README.md from code review. Co-authored-by: Dan Kortschak <[email protected]>

Commit suggested change to changelog.yml from code review. Co-authored-by: Dan Kortschak <[email protected]>

Co-authored-by: Dan Kortschak <[email protected]>

…to faitour

Co-authored-by: Dan Kortschak <[email protected]>

…common-config.yml Co-authored-by: Dan Kortschak <[email protected]>

…to faitour

efd6 · 2025-11-06T22:17:54Z

packages/faitour/img/logo.svg

This is a base64 encoded png at 900×900. I think we could downsize this a little since the icons in the UI are never rendered at that resolution. It looks like 150×150 should be plenty.

efd6 · 2025-11-06T22:18:53Z

packages/faitour/changelog.yml

+# newer versions go on top
+- version: "0.0.1"
+  changes:
+    - description: Initial draft of the package


Suggested change

- description: Initial draft of the package

- description: Initial draft of the package.

efd6 · 2025-11-06T22:19:20Z

packages/faitour/changelog.yml

+  changes:
+    - description: Initial draft of the package
+      type: enhancement
+      link: https://github.com/elastic/integrations/pull/13304


Suggested change

link: https://github.com/elastic/integrations/pull/13304

link: https://github.com/elastic/integrations/pull/15889

efd6 · 2025-11-06T22:20:57Z

packages/faitour/data_stream/application/elasticsearch/ingest_pipeline/default.yml

+  ################################
+  ## Redact passwords if tagged ##
+  ################################
+  - redact:


This will fail in tests running for basic license, so please replace this with gsub; you can get exactly the same functionality with that processor.

efd6 · 2025-11-06T22:22:39Z

packages/faitour/data_stream/application/elasticsearch/ingest_pipeline/default.yml

+## Handle Pipeline Failures ##
+##############################
+on_failure:
+  - append:


Suggested change

- append:

- set:

efd6 · 2025-11-06T22:24:24Z

packages/faitour/data_stream/application/manifest.yml

@@ -0,0 +1,41 @@
+title: "Application Logs"


Suggested change

title: "Application Logs"

title: "Faitour Application Logs"

?

efd6 · 2025-11-06T22:25:17Z

packages/faitour/data_stream/honeypot/elasticsearch/ingest_pipeline/default.yml

Same comments as above.

efd6 · 2025-11-06T22:25:43Z

packages/faitour/data_stream/honeypot/manifest.yml

@@ -0,0 +1,50 @@
+title: "Honeypot Events"


Suggested change

title: "Honeypot Events"

title: "Faitour Honeypot Events"

?

efd6 · 2025-11-06T22:26:44Z

packages/faitour/manifest.yml

Suggested change

type: elastic

type: community

(or "partner" depending on arrangement)

efd6 · 2025-11-06T23:03:00Z

packages/faitour/_dev/build/docs/README.md

We've changed the general structure of the READMEs, so it would be good to update this to match. @alaudazzi can you provide guidance for that here?

efd6 · 2025-11-06T23:03:19Z

/test

elastic-vault-github-plugin-prod · 2025-11-06T23:22:37Z

🚀 Benchmarks report

To see the full report comment with /test benchmark fullreport

elasticmachine · 2025-11-06T23:22:40Z

💚 Build Succeeded

Buildkite Build
Commit: 12d074a

MakoWish and others added 19 commits March 25, 2025 09:39

Initial push of Faitour integration

3392e85

Added entry to changelog.yml

21897b1

Merge branch 'main' into faitour

2a9b461

Update packages/faitour/_dev/build/docs/README.md

383d108

Commit suggested changes to README.md from code review. Co-authored-by: Dan Kortschak <[email protected]>

Update packages/faitour/changelog.yml

4000777

Commit suggested change to changelog.yml from code review. Co-authored-by: Dan Kortschak <[email protected]>

Update packages/faitour/_dev/deploy/docker/docker-compose.yml

f1f9736

Co-authored-by: Dan Kortschak <[email protected]>

Reduce number of test events

c7e5730

Merge branch 'faitour' of https://github.com/MakoWish/integrations in…

a13ccc5

…to faitour

Merge branch 'elastic:main' into faitour

16fb9a3

Merge branch 'faitour' of https://github.com/MakoWish/integrations in…

e13384d

…to faitour

Update packages/faitour/_dev/build/build.yml

a60bd27

Co-authored-by: Dan Kortschak <[email protected]>

Update packages/faitour/data_stream/honeypot/_dev/test/pipeline/test-…

7db1a3a

…common-config.yml Co-authored-by: Dan Kortschak <[email protected]>

Update packages/faitour/data_stream/honeypot/_dev/test/pipeline/test-…

3500bf6

…common-config.yml Co-authored-by: Dan Kortschak <[email protected]>

Merge branch 'faitour' of https://github.com/MakoWish/integrations in…

2eace54

…to faitour

Change for code review.

543abfb

Additional corrections from code review

c6f5c62

Separated application and honeypot logging

e31f651

Change references of Faitour2 to Faitour

a9e248e

Merge branch 'main' into faitour

d52e202

andrewkroh added New Integration Issue or pull request for creating a new integration package. documentation Improvements or additions to documentation. Applied to PRs that modify *.md files. labels Nov 6, 2025

Corrected manifests

12d074a

MakoWish marked this pull request as ready for review November 6, 2025 21:57

MakoWish requested a review from a team as a code owner November 6, 2025 21:57

efd6 reviewed Nov 6, 2025

View reviewed changes

	- description: Initial draft of the package
	- description: Initial draft of the package.

	link: https://github.com/elastic/integrations/pull/13304
	link: https://github.com/elastic/integrations/pull/15889

[Faitour Honeypot] Initial Push of Beta Integration #15889

Are you sure you want to change the base?

[Faitour Honeypot] Initial Push of Beta Integration #15889

Conversation

MakoWish commented Nov 6, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Type of change

Proposed commit message

Checklist

Author's Checklist

Notes

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

efd6 commented Nov 6, 2025

Uh oh!

elastic-vault-github-plugin-prod bot commented Nov 6, 2025

🚀 Benchmarks report

Uh oh!

elasticmachine commented Nov 6, 2025

💚 Build Succeeded

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

4 participants

MakoWish commented Nov 6, 2025 •

edited

Loading