[Neon Cyber] New Elastic integration neon_cyber for the Neon Cyber platform

.github/CODEOWNERS

@@ -333,6 +333,7 @@
 /packages/mysql_otel @elastic/obs-infraobs-integrations
 /packages/nagios_xi @elastic/obs-infraobs-integrations
 /packages/nats @elastic/obs-infraobs-integrations
+/packages/neon_cyber @elastic/security-service-integrations
 /packages/netflow @elastic/integration-experience
 /packages/netscout @elastic/integration-experience
 /packages/netskope @elastic/security-service-integrations

packages/neon_cyber/_dev/build/build.yml

@@ -0,0 +1,3 @@
+dependencies:
+  ecs:
+    reference: git@v8.17.0

packages/neon_cyber/_dev/build/docs/README.md

@@ -0,0 +1,44 @@
+# Neon Cyber Integration for Elastic
+
+## Overview
+
+The [Neon Cyber](https://www.neoncyber.com) integration for Elastic enables collection of workforce events and cybersecurity detections from the Neon [API](https://api.neoncyber.io/v1/docs])
+
+## What data does this integration collect?
+
+The Neon Cyber integration collects log messages of the following types:
+* Events including geo, navigation, auth, app, extensions, and platform
+* Detections including compromised credentials, phishing, malware, and more
+
+### What do I need to use this integration?
+
+This integration requires you to generate a developer API key from the account settings of your Neon Cyber instance.
+
+## How do I deploy this integration?
+
+### Agent-based deployment
+
+Elastic Agent must be installed. For more details, check the Elastic Agent [installation instructions](docs-content://reference/fleet/install-elastic-agents.md). You can install only one Elastic Agent per host.
+
+Elastic Agent is required to stream data from the syslog or log file receiver and ship the data to Elastic, where the events will then be processed via the integration's ingest pipelines.
+
+### Agentless Enabled Integration
+
+Agentless integrations allow you to collect data without having to manage Elastic Agent in your cloud. They make manual agent deployment unnecessary, so you can focus on your data instead of the agent that collects it. For more information, refer to [Agentless integrations](https://www.elastic.co/guide/en/serverless/current/security-agentless-integrations.html) and the [Agentless integrations FAQ](https://www.elastic.co/guide/en/serverless/current/agentless-integration-troubleshooting.html).
+
+Agentless deployments are only supported in Elastic Serverless and Elastic Cloud environments.  This functionality is in beta and is subject to change. Beta features are not subject to the support SLA of official GA features.
+
+
+## Inputs used
+
+### Event Logs
+
+{{event "events"}}
+
+{{fields "events"}}
+
+### Detection Logs
+
+{{event "detections"}}
+
+{{fields "detections"}}

packages/neon_cyber/_dev/deploy/docker/docker-compose.yml

@@ -0,0 +1,14 @@
+services:
+  neon_cyber:
+    image: docker.elastic.co/observability/stream:v0.18.0
+    hostname: neon_cyber
+    ports:
+      - 8080
+    volumes:
+      - ./files:/files:ro
+    environment:
+      PORT: 8080
+    command:
+      - http-server
+      - --addr=:8080
+      - --config=/files/config.yml

packages/neon_cyber/_dev/deploy/docker/files/config.yml

@@ -0,0 +1,27 @@
+rules:
+    - path: /v1/events
+      methods: ['GET']
+      request_headers:
+          authorization: xxxx
+      responses:
+          - status_code: 200
+            body: |-
+                {{ minify_json `
+                {
+                  "error": null,
+                  "data": [{"id":"95cf3375-6a70-4366-9a4d-8bb602b0d7c9","deployment_id":"ec080215-913c-490c-bb81-a1baa311ee45","client_id":"d19143bd-3a34-4c7e-886b-87f643df4835","registration_id":"a00db187-ad55-4074-8a84-d085555abe29","event_type":"auth","event_timestamp":"2025-10-12T21:39:13.241+00:00","inserted_at":"2025-10-13T18:13:17.312372+00:00","updated_at":"2025-10-13T18:13:17.312372+00:00","agent":"1.2.4","arch":"arm64","display":"Chrome","name":"chrome","os":"linux","ua":"Mozilla/5.0 (X11; Linux aarch64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36","version":"134.0.0.0","latitude":11.1111,"longitude":-0.111,"ip_latitude":11.1111,"ip_longitude":-0.111,"asn":9105,"asn_isp":"TalkTalk","city":"Brighton","country":"GB","postal_code":"BN3","region_code":"BNH","region_name":"Brighton and Hove","ip":"192.0.2.1","description":"User authenticated using userpass for https://www.bluthfamily.biz","url":"https://www.bluthfamily.biz","auth_method":"userpass","email":"barry@bluthfamily.biz","autofill":true}]
+                }
+                `}}
+    - path: /v1/detections
+      methods: ['GET']
+      request_headers:
+          authorization: xxxx
+      responses:
+          - status_code: 200
+            body: |-
+                {{ minify_json `
+                {
+                  "error": null,
+                  "data": [{"id":"c24b2526-11e4-48bf-af45-f6837232037f","deployment_id":"ec080215-913c-490c-bb81-a1baa311ee45","client_id":"d19143bd-3a34-4c7e-886b-87f643df4835","registration_id":"a00db187-ad55-4074-8a84-d085555abe29","detection_type":"phishing","detection_subtype":null,"detection_timestamp":"2025-10-10T17:09:32.988+00:00","inserted_at":"2025-10-13T18:13:15.88219+00:00","updated_at":"2025-10-13T18:13:15.88219+00:00","source":"Phishing AI","description":null,"tab_id":12345,"url":"https://click.this.link.banckcorp.com","incognito":false,"agent":"1.2.4","arch":"arm64","display":"Chrome","name":"chrome","os":"linux","ua":"Mozilla/5.0 (X11; Linux aarch64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36","version":"134.0.0.0","latitude":11.1111,"longitude":-0.111,"ip_latitude":11.1111,"ip_longitude":-0.111,"asn":9105,"asn_isp":"TalkTalk","city":"Brighton","country":"GB","postal_code":"BN3","region_code":"BNH","region_name":"Brighton and Hove","ip":"192.0.2.1"}]
+                }
+                `}}

packages/neon_cyber/changelog.yml

@@ -0,0 +1,6 @@
+# newer versions go on top
+- version: "0.1.0"
+  changes:
+    - description: Initial version of the package.
+      type: enhancement
+      link: https://github.com/elastic/integrations/pull/15725

packages/neon_cyber/data_stream/detections/_dev/test/pipeline/test-detections.log

@@ -0,0 +1,3 @@
+{"id":"344d53e6-43b4-4cdd-84ad-9421a5f6dc31","deployment_id":"ec080215-913c-490c-bb81-a1baa311ee45","client_id":"d19143bd-3a34-4c7e-886b-87f643df4835","registration_id":"a00db187-ad55-4074-8a84-d085555abe29","detection_type":"form","detection_subtype":null,"detection_timestamp":"2025-10-10T17:09:32.988+00:00","inserted_at":"2025-10-13T18:13:16.648002+00:00","updated_at":"2025-10-13T18:13:16.648002+00:00","source":"Compromised Credential","description":null,"tab_id":12345,"url":"https://support.notanapp.com","incognito":false,"agent":"1.2.4","arch":"arm64","display":"Chrome","name":"chrome","os":"linux","ua":"Mozilla/5.0 (X11; Linux aarch64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36","version":"134.0.0.0","latitude":11.1111,"longitude":-0.111,"ip_latitude":11.1111,"ip_longitude":-0.111,"asn":9105,"asn_isp":"TalkTalk","city":"Brighton","country":"GB","postal_code":"BN3","region_code":"BNH","region_name":"Brighton and Hove","ip":"192.0.2.1","action":"/login?","email":"barry@bluthfamily.biz","password":true,"pii":false,"compromised":true,"autofill":null,"catalog_id":null}
+{"id":"c24b2526-11e4-48bf-af45-f6837232037f","deployment_id":"ec080215-913c-490c-bb81-a1baa311ee45","client_id":"d19143bd-3a34-4c7e-886b-87f643df4835","registration_id":"a00db187-ad55-4074-8a84-d085555abe29","detection_type":"phishing","detection_subtype":null,"detection_timestamp":"2025-10-10T17:09:32.988+00:00","inserted_at":"2025-10-13T18:13:15.88219+00:00","updated_at":"2025-10-13T18:13:15.88219+00:00","source":"Phishing AI","description":null,"tab_id":12345,"url":"https://click.this.link.banckcorp.com","incognito":false,"agent":"1.2.4","arch":"arm64","display":"Chrome","name":"chrome","os":"linux","ua":"Mozilla/5.0 (X11; Linux aarch64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36","version":"134.0.0.0","latitude":11.1111,"longitude":-0.111,"ip_latitude":11.1111,"ip_longitude":-0.111,"asn":9105,"asn_isp":"TalkTalk","city":"Brighton","country":"GB","postal_code":"BN3","region_code":"BNH","region_name":"Brighton and Hove","ip":"192.0.2.1"}
+{"id":"34a32dcf-3e71-4688-8ae6-46376c571bf9","deployment_id":"ec080215-913c-490c-bb81-a1baa311ee45","client_id":"d19143bd-3a34-4c7e-886b-87f643df4835","registration_id":"a00db187-ad55-4074-8a84-d085555abe29","detection_type":"download","detection_subtype":null,"detection_timestamp":"2025-10-10T17:09:32.988+00:00","inserted_at":"2025-10-13T18:13:16.149791+00:00","updated_at":"2025-10-13T18:13:16.149791+00:00","source":"Download Incognito","description":null,"tab_id":12345,"url":"https://example.com/docs/support","incognito":true,"agent":"1.2.4","arch":"arm64","display":"Chrome","name":"chrome","os":"linux","ua":"Mozilla/5.0 (X11; Linux aarch64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36","version":"134.0.0.0","latitude":11.1111,"longitude":-0.111,"ip_latitude":11.1111,"ip_longitude":-0.111,"asn":9105,"asn_isp":"TalkTalk","city":"Brighton","country":"GB","postal_code":"BN3","region_code":"BNH","region_name":"Brighton and Hove","ip":"192.0.2.1","filename":"2024_financials.xls","mime":"application/pdf","danger":"SAFE","total_bytes":31337}