[Cato Networks][Event] Add cato networks event data-stream

[sharadcrest]

Proposed commit message

The initial release includes event data stream and associated dashboard.

Cato Networks fields are mapped to their corresponding ECS fields where possible.

Test samples were derived from live data samples, which were subsequently
sanitized.

Checklist

• I have reviewed tips for building integrations and this pull request is aligned with them.
• I have verified that all data streams collect metrics or logs.
• I have added an entry to my package's changelog.yml file.
• I have verified that Kibana version constraints are current according to guidelines.
• I have verified that any added dashboard complies with Kibana's Dashboard good practices

How to test this PR locally

To test the cato networks package:

• Clone integrations repo.
• Install elastic package locally.
• Start elastic stack using elastic-package.
• Move to integrations/packages/cato_networks directory.
• Run the following command to run tests.

elastic-package test

--- Test results for package: cato_networks - START ---
╭───────────────┬─────────────┬───────────┬────────────────────────────────────────────────────────────────────────┬────────┬──────────────╮
│ PACKAGE       │ DATA STREAM │ TEST TYPE │ TEST NAME                                                              │ RESULT │ TIME ELAPSED │
├───────────────┼─────────────┼───────────┼────────────────────────────────────────────────────────────────────────┼────────┼──────────────┤
│ cato_networks │             │ asset     │ dashboard cato_networks-9d363f59-caa0-4b84-af82-dd85d789a7dd is loaded │ PASS   │        1.9µs │
│ cato_networks │             │ asset     │ search cato_networks-7d5f3596-eb8a-43cc-be1c-66d80fb18853 is loaded    │ PASS   │        594ns │
│ cato_networks │             │ asset     │ search cato_networks-fa1fade5-b107-4f85-9d3a-2a2103ed3ab0 is loaded    │ PASS   │        122ns │
│ cato_networks │             │ asset     │ search cato_networks-fb73f336-127f-4d49-94dd-709c0da4c5d1 is loaded    │ PASS   │        120ns │
│ cato_networks │ event       │ asset     │ index_template logs-cato_networks.event is loaded                      │ PASS   │        161ns │
│ cato_networks │ event       │ asset     │ ingest_pipeline logs-cato_networks.event-0.1.0 is loaded               │ PASS   │        200ns │
╰───────────────┴─────────────┴───────────┴────────────────────────────────────────────────────────────────────────┴────────┴──────────────╯
--- Test results for package: cato_networks - END   ---
Done
Run pipeline tests for the package
2026/03/12 13:52:58  INFO elastic-package v0.118.0 version-hash 816ceecf (build time: 2025-12-30T18:33:37+05:30)
2026/03/12 13:52:58  INFO elastic-stack: 8.18.0
--- Test results for package: cato_networks - START ---
╭───────────────┬─────────────┬───────────┬───────────────────────────────────────────┬────────┬──────────────╮
│ PACKAGE       │ DATA STREAM │ TEST TYPE │ TEST NAME                                 │ RESULT │ TIME ELAPSED │
├───────────────┼─────────────┼───────────┼───────────────────────────────────────────┼────────┼──────────────┤
│ cato_networks │ event       │ pipeline  │ (ingest pipeline warnings test-event.log) │ PASS   │ 390.607655ms │
│ cato_networks │ event       │ pipeline  │ test-event.log                            │ PASS   │ 336.251639ms │
╰───────────────┴─────────────┴───────────┴───────────────────────────────────────────┴────────┴──────────────╯
--- Test results for package: cato_networks - END   ---
Done
Run policy tests for the package
2026/03/12 13:52:59  INFO elastic-package v0.118.0 version-hash 816ceecf (build time: 2025-12-30T18:33:37+05:30)
2026/03/12 13:52:59  INFO elastic-stack: 8.18.0
--- Test results for package: cato_networks - START ---
No test results
--- Test results for package: cato_networks - END   ---
Done
Run script tests for the package
PKG cato_networks
[no test files]
--- Test results for package: cato_networks - START ---
No test results
--- Test results for package: cato_networks - END   ---
Done
Run static tests for the package
2026/03/12 13:52:59  INFO elastic-package v0.118.0 version-hash 816ceecf (build time: 2025-12-30T18:33:37+05:30)
--- Test results for package: cato_networks - START ---
╭───────────────┬─────────────┬───────────┬──────────────────────────┬────────┬──────────────╮
│ PACKAGE       │ DATA STREAM │ TEST TYPE │ TEST NAME                │ RESULT │ TIME ELAPSED │
├───────────────┼─────────────┼───────────┼──────────────────────────┼────────┼──────────────┤
│ cato_networks │ event       │ static    │ Verify sample_event.json │ PASS   │ 166.717788ms │
╰───────────────┴─────────────┴───────────┴──────────────────────────┴────────┴──────────────╯
--- Test results for package: cato_networks - END   ---
Done
Run system tests for the package
2026/03/12 13:52:59  INFO elastic-package v0.118.0 version-hash 816ceecf (build time: 2025-12-30T18:33:37+05:30)
2026/03/12 13:52:59  INFO elastic-stack: 8.18.0
2026/03/12 13:52:59  INFO Installing package...
2026/03/12 13:52:59  INFO License text found in "/home/devuser/github/integrations/LICENSE.txt" will be included in package
2026/03/12 13:53:12  INFO Running test for data_stream "event" with configuration 'default'
2026/03/12 13:53:21  INFO Setting up independent Elastic Agent...
2026/03/12 13:53:34  INFO Setting up service...
2026/03/12 13:54:24  INFO Validating test case...
2026/03/12 13:54:25  INFO Tearing down service...
2026/03/12 13:54:26  INFO Write container logs to file: /home/devuser/github/integrations/build/container-logs/cato_networks-1773303866327696761.log
2026/03/12 13:54:28  INFO Tearing down agent...
2026/03/12 13:54:28  INFO Write container logs to file: /home/devuser/github/integrations/build/container-logs/elastic-agent-1773303868856230541.log
2026/03/12 13:54:38  INFO Uninstalling package...
--- Test results for package: cato_networks - START ---
╭───────────────┬─────────────┬───────────┬───────────┬────────┬─────────────────╮
│ PACKAGE       │ DATA STREAM │ TEST TYPE │ TEST NAME │ RESULT │    TIME ELAPSED │
├───────────────┼─────────────┼───────────┼───────────┼────────┼─────────────────┤
│ cato_networks │ event       │ system    │ default   │ PASS   │ 1m13.324775141s │
╰───────────────┴─────────────┴───────────┴───────────┴────────┴─────────────────╯
--- Test results for package: cato_networks - END   ---
Done

Screenshots

[elastic-vault-github-plugin-prod]

Reviewers

Buildkite won't run for external contributors automatically; you need to add a comment:

• /test : will kick off a build in Buildkite.

NOTE: https://github.com/elastic/integrations/blob/main/.buildkite/pull-requests.json contains all those details.