Set a single solution category on datastream level for dual-tagged (obs/sec) packages

[tdancheva]

Proposed commit message

WHAT: For the 18 packages that are dual-tagged security + observability at package level, set a single solution category on each data stream that did not already have one in its datastream manifest.yml. Package-level categories stay dual.

Pattern follows #19911: keep non-solution categories (aws, cloud, network, …); write exactly one of security | observability on the datastream; also copy any extra policy-template categories (lint requires the datastream list to be a superset of the template); patch-bump the package; changelog bugfix.

Scope: 173 datastreams.

• 125 had no datastream-level solution category → filled (55 security / 70 observability).
• 48 already had security and/or observability on the datastream manifest → left unchanged (42 unique observability, 6 dual).

Assignment for streams that needed a fill, in order:

1. Datastream CODEOWNERS / policy-template categories, if uniquely security or observability.
2. If those disagree, git blame — latest author-date wins.
3. Else package owner.github, then package CODEOWNERS.
4. Ambiguous owners: elastic-agent-data-plane → observability; cloud-services + Defend for Containers → security; integration-experience + Falco → security.
5. Lint: datastream categories must include every policy-template category. Extra tags are unioned in. If the policy template already has a unique solution category, that wins over CODEOWNERS (cannot drop a policy template solution tag).

Left dual on purpose (already had both on the datastream manifest; ownership logic would have collapsed them):

• gcp.loadbalancing_logs, gcp.loadbalancing_metrics, aws.transitgateway — logic would pick observability (CODEOWNERS obs-infraobs vs policy-template security; blame Update cloud packages codeowner #8672).
• gcp.vpcflow — logic would pick security (SSI CODEOWNERS + security policy template).
• tencent_cloud.clb, tencent_cloud.cos — logic would pick security (package owner SSI; dual policy-template cats).

Filled streams where ownership logic disagreed with the policy template, then aligned to the template for lint:

• Azure auditlogs / signinlogs / identity_protection / provisioning → security (template adlogs; CODEOWNERS would have been observability).
• aws.vpcflow → observability (+ network) (template; CODEOWNERS SSI would have been security).

More details on how the decision was taken on datastream level in comment.

WHY:
This metadata will be used to re-define the Obs and Security marker, i.e. how do we define Obs/Sec customer based on our telemetry.

Dual solution categories at datastream level make security vs observability ownership ambiguous for markers. Same problem #19911 fixed for a subset of GCP/AWS streams. This extends that to the remaining dual-tagged packages, without overwriting an existing datastream-manifest solution category.

Packages (patch bump): o365_metrics, windows, openai, mongodb_atlas, oracle, cloud_defend, microsoft_sqlserver, panw_metrics, sysdig, zoom, aws_bedrock, azure_frontdoor, falco, menlo, gcp, azure, tencent_cloud, aws.

Checklist

• I have reviewed tips for building integrations and this pull request is aligned with them.
• I have verified that all data streams collect metrics or logs.
• I have added an entry to my package's changelog.yml file.
• I have verified that Kibana version constraints are current according to guidelines.
• I have verified that any added dashboard complies with Kibana's Dashboard good practices

Author's Checklist

• [ ]

How to test this PR locally

Related issues

• Relates https://github.com/elastic/observability-bi/issues/1409
• Closes https://github.com/elastic/observability-bi/issues/1867

Screenshots

[github-actions]

✅ Elastic Docs Style Checker (Vale)

No issues found on modified lines!

---

The Vale linter checks documentation changes against the Elastic Docs style guide. To use Vale locally or report issues, refer to Elastic style guide for Vale.

[elastic-vault-github-plugin-prod]

✅ All changelog entries have the correct PR link.

[infra-vault-gh-plugin-prod]

💔 Build Failed

• Buildkite Build
• Commit: 92f3c1a

Failed CI Steps

• Check integrations aws
• Check integrations aws_bedrock

History

• 💔 Build #47810 failed 69ee5d4
• 💔 Build #47807 failed 097f4f1

[elastic-vault-github-plugin-prod]

🚀 Benchmarks report

To see the full report comment with /test benchmark fullreport