[dashboard-data-scope] Gigamon dashboards contain stale Lens data-view ID causing broken panel sources

## Findings

### 1. Gigamon dashboards embed a stale static `indexPatternId` that is not installed by the package

**Location**
- `packages/gigamon/kibana/dashboard/gigamon-d6cecabb-f026-4823-914d-b4d61fd61787.json:155,201,685,746`
- Same stale ID appears in 7 additional dashboards:
- `packages/gigamon/kibana/dashboard/gigamon-032aab7b-87b2-444c-8c86-956d092598fb.json:1409,1540`
- `packages/gigamon/kibana/dashboard/gigamon-46931a21-a33e-43af-aadf-da8d6446b9cc.json:842,896`
- `packages/gigamon/kibana/dashboard/gigamon-4ae2cd9a-3eef-42c6-a02c-731ce74d94ac.json:415,461`
- `packages/gigamon/kibana/dashboard/gigamon-62291e9e-8b75-4f23-9121-79959da99b3b.json:78,134`
- `packages/gigamon/kibana/dashboard/gigamon-855a64dc-1a72-403f-932b-a5b848378f7e.json:75,124,682,729,836,884`
- `packages/gigamon/kibana/dashboard/gigamon-8f772203-64e0-4d1b-bb0e-14fa57b4b754.json:386,433`
- `packages/gigamon/kibana/dashboard/gigamon-e192a946-8287-450a-a8f0-e23de9f95dae.json:1135,1181,1289,1390`

**Evidence**
- Lens state uses a static UUID as the active datasource ID:
- `"currentIndexPatternId": "e3f451b1-4c23-4305-bcbf-0bc812d1ba07"`
- `"indexPatternId": "e3f451b1-4c23-4305-bcbf-0bc812d1ba07"`
- The same panel references a different data view via references:
- `"id": "logs-*", "type": "index-pattern"`
- Package assets do not install that UUID data view:
- no files under `packages/gigamon/kibana/index_pattern/*.json`
- only datastream is logs `gigamon.ami` (`packages/gigamon/data_stream/ami/manifest.yml`)

**What is wrong**
Dashboard panels declare a hard-coded data-view UUID that is not shipped by the integration, while panel references point to `logs-*`. This leaves panel datasource state internally inconsistent and dependent on an external saved object that may not exist.

**Why it matters**
Users can hit broken or missing panel data-source behavior in Kibana environments where `e3f451b1-4c23-4305-bcbf-0bc812d1ba07` does not exist. This is user-visible and affects multiple Gigamon dashboards.

**Suggested fix**
- Remove stale static `currentIndexPatternId`/`indexPatternId` UUIDs from Lens state in affected dashboards.
- Align panel datasource state with installed/scoped data views for this package (Gigamon AMI logs), and regenerate dashboards so references and state use the same resolvable data view.

## Suggested Actions

- [ ] Replace stale `e3f451b1-4c23-4305-bcbf-0bc812d1ba07` IDs in all 8 affected Gigamon dashboards.
- [ ] Regenerate/export dashboards to ensure Lens datasource IDs match package-installed/referenced data views.
- [ ] Add a package validation check preventing uninstalled static `indexPatternId` UUIDs in dashboard assets.

## Audit Coverage

- Total dashboards scanned: **1207**
- Dashboards with confirmed findings: **8** (Gigamon)

## Duplicate Check

- Previously filed dashboard-data-scope finding in `/tmp/previous-findings.json` is `#18065` (Azure OpenAI / AWS ELB OTEL / Proofpoint) and does not cover Gigamon stale Lens data-view IDs.

> [!NOTE]
>
> 🔒 Integrity filtering filtered 1 item
>
> Integrity filtering activated and filtered the following item during workflow execution.
> This happens when a tool call accesses a resource that does not meet the required integrity or secrecy level of the workflow.
>
> - issue:#unknown (`search_issues`: has lower integrity than agent requires. The agent cannot read data with integrity below "approved".)
>
>

---
[What is this?](https://ela.st/github-ai-tools) | [From workflow: Sweeper: Dashboard Data Scope and Filter Integrity](https://github.com/elastic/integrations/actions/runs/23893559375)

Give us feedback! React with 🚀 if perfect, 👍 if helpful, 👎 if not.
> - [x] expires on Apr 9, 2026, 9:46 AM UTC