[Digital Guardian]: Include export profile in events

[andrewkroh]

Integration Name

Digital Guardian [digital_guardian]

Dataset Name

digital_guardian.arc

Integration Version

1.3.1

Agent Version

8.16.1

OS Version and Architecture

Amazon Linux

User Goal

When running multiple instances of the integration, I want to be able to associate events back to the export profile that produced the event. As far as I can tell there is no way to associate the data to an export ID.

I would like to have a field such as digital_guardian.arc.export_profile that contains the profile UUID.

Existing Features

n/a

What did you see?

Events with no way to associate them with an export profile.

Anything else?

I noticed that the CEL program references a Handlebar variable directly. Programs should not do this. Instead configuration data should be passed through state. e.g.

state:
  export_profile: {{escape_string export_profile}}

integrations/packages/digital_guardian/data_stream/arc/agent/stream/cel.yml.hbs

Line 27 in ca5e7bf

state.url + "/rest/1.0/export_profiles/{{export_profile}}/export_and_ack"

[elasticmachine]

Pinging @elastic/security-service-integrations (Team:Security-Service Integrations)