[dashboard-data-scope] High-severity unscoped dashboard data views in macOS and Microsoft SQL Server OTel

## Findings

### 1. macOS Security Events dashboard queries global `logs-*` without integration scoping

**Location**
- `packages/macos/kibana/dashboard/macos-4b49d421-2f03-4dd2-891f-cbd7e2786e35.json`
- Controls: `15`, `34`
- Lens data source: `162`, `171`, `231`, `237`
- Dashboard search source has no filter: `57-61`

**Evidence**
- Controls use global data view:
- `"dataViewId": "logs-*"` (lines `15`, `34`)
- Lens panels use global logs data source:
- `"id": "logs-*"` (line `162`)
- `"currentIndexPatternId": "logs-*"` (line `171`)
- `"indexPatternId": "logs-*"` (line `231`)
- No dashboard-level scoping:
- `"filter": []` and `"query": ""` (lines `57-61`)
- Visualization uses generic ECS field:
- `"sourceField": "event.category"` (line `214`)

**What is wrong**
The dashboard belongs to the macOS integration but uses global `logs-*` as the active control and Lens data source with no dataset/module filter, so queries are not restricted to macOS data streams.

**Why it matters**
Users with multiple integrations installed will see non-macOS logs mixed into “macOS Security Events” visualizations and control values, producing immediately misleading dashboards.

**Suggested fix**
Replace global data sources with macOS-scoped patterns and enforce dataset scoping at dashboard level:
- Use `logs-macos.*-*` (or equivalent package-installed scoped data views) instead of `logs-*`.
- Add a mandatory filter such as `data_stream.dataset: macos.*`.

---

### 2. Microsoft SQL Server OTel dashboards use global control data views and suppress `SVR00002` without rationale

**Location**
- `packages/microsoft_sqlserver_otel/kibana/dashboard/microsoft_sqlserver_otel-overview.json`
- Empty dashboard scope: `1620-1623`
- Global control source: `1646`
- `packages/microsoft_sqlserver_otel/kibana/dashboard/microsoft_sqlserver_otel-query-performance.json`
- Empty dashboard scope: `2165-2168`
- Global control source: `2191`
- `packages/microsoft_sqlserver_otel/validation.yml:1-3`

**Evidence**
- Unscoped controls:
- `"dataViewId": "metrics-*"` (overview line `1646`)
- `"dataViewId": "logs-*"` (query-performance line `2191`)
- No dashboard-level scoping:
- `"filter": []` and empty kuery in both dashboards (`1620-1623`, `2165-2168`)
- Validator suppression with no explanation:
- `exclude_checks: - SVR00002` (`validation.yml:1-3`)
- Package dataset declaration:
- `packages/microsoft_sqlserver_otel/manifest.yml:19-20` → `sqlserverreceiver.otel`

**What is wrong**
Control panels query global logs/metrics views instead of SQL Server OTel-scoped data, and the package suppresses `SVR00002` without rationale.

**Why it matters**
Instance dropdown values can include unrelated integrations that also emit `resource.attributes.service.instance.id`, making filtering unreliable and user-visible on first load.

**Suggested fix**
- Scope controls to package dataset views (e.g., `metrics-sqlserverreceiver.otel-*` and `logs-sqlserverreceiver.otel-*`).
- Add mandatory dataset filters in dashboard search sources.
- Remove `SVR00002` suppression after fixing scope, or annotate with explicit rationale/tracking if temporary.

## Stale `indexPatternId` references

No new high-severity stale static `indexPatternId` findings were confirmed beyond already-open issues `#18065` and `#18200`.

## Packages with `SVR00002` suppressed without explanation (confirmed finding set)

- `microsoft_sqlserver_otel` (`packages/microsoft_sqlserver_otel/validation.yml:1-3`)

## Audit coverage

- Total dashboards scanned: **1248**
- Dashboards/packages with confirmed new high-severity findings: **3 dashboards across 2 packages** (`macos`, `microsoft_sqlserver_otel`)

> [!NOTE]
>
> 🔒 Integrity filtering filtered 104 items
>
> Integrity filtering activated and filtered the following items during workflow execution.
> This happens when a tool call accesses a resource that does not meet the required integrity or secrecy level of the workflow.
>
> - issue:elastic/integrations#18200 (`issue_read`: has lower integrity than agent requires. The agent cannot read data with integrity below "approved".)
> - issue:elastic/integrations#18065 (`issue_read`: has lower integrity than agent requires. The agent cannot read data with integrity below "approved".)
> - issue:#unknown (`search_issues`: has lower integrity than agent requires. The agent cannot read data with integrity below "approved".)
> - issue:elastic/integrations#18303 (`list_issues`: has lower integrity than agent requires. The agent cannot read data with integrity below "approved".)
> - issue:elastic/integrations#18294 (`list_issues`: has lower integrity than agent requires. The agent cannot read data with integrity below "approved".)
> - issue:elastic/integrations#18293 (`list_issues`: has lower integrity than agent requires. The agent cannot read data with integrity below "approved".)
> - issue:elastic/integrations#18292 (`list_issues`: has lower integrity than agent requires. The agent cannot read data with integrity below "approved".)
> - issue:elastic/integrations#18291 (`list_issues`: has lower integrity than agent requires. The agent cannot read data with integrity below "approved".)
> - issue:elastic/integrations#18290 (`list_issues`: has lower integrity than agent requires. The agent cannot read data with integrity below "approved".)
> - issue:elastic/integrations#18289 (`list_issues`: has lower integrity than agent requires. The agent cannot read data with integrity below "approved".)
> - issue:elastic/integrations#18288 (`list_issues`: has lower integrity than agent requires. The agent cannot read data with integrity below "approved".)
> - issue:elastic/integrations#18284 (`list_issues`: has lower integrity than agent requires. The agent cannot read data with integrity below "approved".)
> - issue:elastic/integrations#18281 (`list_issues`: has lower integrity than agent requires. The agent cannot read data with integrity below "approved".)
> - issue:elastic/integrations#18279 (`list_issues`: has lower integrity than agent requires. The agent cannot read data with integrity below "approved".)
> - issue:elastic/integrations#18277 (`list_issues`: has lower integrity than agent requires. The agent cannot read data with integrity below "approved".)
> - issue:elastic/integrations#18276 (`list_issues`: has lower integrity than agent requires. The agent cannot read data with integrity below "approved".)
> - ... and 88 more items
>
>

---
[What is this?](https://ela.st/github-ai-tools) | [From workflow: Sweeper: Dashboard Data Scope and Filter Integrity](https://github.com/elastic/integrations/actions/runs/24182982147)

Give us feedback! React with 🚀 if perfect, 👍 if helpful, 👎 if not.
> - [x] expires on Apr 16, 2026, 9:44 AM UTC