Integrations

An integration groups the parsers and mappers that turn one source's raw events into a normalized events_ecs dataset.

An integration's id is prefixed INT_. Its parsers read connectors and land raw events as structured tables, while its mappers normalize those tables into ECS. Every deployed mapper contributes a branch to the composite view, the events_ecs.<integration> dataset that detections can read. The integration owns its parsers, mappers, derived view, retention settings, and folder settings, but holds no query of its own. The composite view runs its mapping logic at query time.

Deployability

An integration has no deploy field of its own. It belongs under Deployable content because it exists to group deployable parsers and mappers and own the composite view they build.

Inputs

Field	Type	Required	Description
name	string	Required	Integration name. On commit it must start with a letter, end with a letter, number, underscore, or closing parenthesis, and contain only letters, numbers, spaces, underscores, hyphens, dots, or parentheses.
retentionDays	integer	Optional	Retention period for the derived view. null uses the Space default.
folderPath	string	Optional	Folder location within the Space, e.g. Integrations.

Outputs

Field	Type	Description
parsers	array<object>	The parsers under this integration. Each entry is the parser's id (PRS_) and name.
mappers	array<object>	The mappers under this integration. Each entry is the mapper's id (MPR_) and name.
status	enum	Worst deployment state across the datasets produced by enabled parsers and mappers: UNDEPLOYED, DEPLOYED, UPDATE_PENDING, FAILED.
viewId	string	The composite view that unions the deployed mappers' output, prefixed VIE_. The field is null until a deployed mapper creates the view.
viewName	string	The composite view's schema.name, such as events_ecs.okta. Perpetual sets it to events_ecs.<integration> when creating the integration, before the composite view exists.
folderId	string	The folder holding the integration, prefixed FLD_, or null when it sits at the Space root.
readOnly	boolean	true for integrations you cannot edit in place, such as one installed from a content pack.
installedFromPack	object	The content pack that installed the integration, identified by id (PAK_) and name.

Plus the common resource fields.

Related

• Parsers, which read connectors and land raw event tables under the integration.
• Mappers, which normalize parser tables into ECS and branch into the composite view.
• Connectors, the source an integration's parsers read.
• Views, the composite events_ecs view an integration derives.
• Content packs, which can install an integration read-only.
• Parse custom data, how to write and deploy a parser.
• Map a source to ECS, how to write and deploy a mapper.