[New Integration] NemoClaw

## Description

Create an Elastic integration for [NVIDIA NemoClaw](https://github.com/NVIDIA/NemoClaw) that ingests logs from its four distinct log-producing components: the blueprint runner, the OpenShell sandbox container, the OpenShell gateway, and the inference routing layer.

NemoClaw is an alpha-stage (as of March 2026) open source stack that runs [OpenClaw](https://openclaw.ai) agents inside an OpenShell sandbox with Landlock + seccomp + network namespace isolation. It runs on k3s and is deployed via a single `nemoclaw onboard` CLI flow. The primary monitoring surface today is log-based; there is no native Prometheus or OTEL metrics endpoint.

## Log sources and datastreams

The integration should produce four datastreams. In practice, the NemoClaw CLI (`openclaw nemoclaw logs`) may emit blueprint and sandbox logs in a mixed stream — ingest pipeline logic will be needed to route by source component field if one is present, or by log pattern if not. This should be validated against real log output early in implementation.

### `logs-nemoclaw.blueprint`

Events from `runner.py` covering the blueprint lifecycle: resolve, verify digest, plan, apply, and status transitions. Low volume. Structured around blueprint run IDs.

| NemoClaw field | ECS mapping | Notes |
|---|---|---|
| Blueprint run ID | `labels.run_id` | Correlates all events within a single blueprint execution |
| Blueprint version | `labels.blueprint_version` | From `blueprint.yaml` manifest |
| Lifecycle phase | `event.action` | `resolve`, `verify`, `plan`, `apply`, `status` |
| Outcome | `event.outcome` | `success`, `failure` |
| Failure reason | `event.reason` | Present on failures |
| Sandbox name | `labels.sandbox_name` | |
| Timestamp | `@timestamp` | |

### `logs-nemoclaw.sandbox`

Agent process logs from inside the OpenShell sandbox container. Highest volume stream. Format is controlled by OpenClaw running inside the sandbox, not NemoClaw directly — an ingest pipeline will be required to normalize this.

| NemoClaw field | ECS mapping | Notes |
|---|---|---|
| Sandbox name | `labels.sandbox_name` | |
| Agent name | `labels.agent_name` | e.g. `main` |
| Session ID | `labels.session_id` | From `--session-id` flag |
| Log level | `log.level` | |
| Message | `message` | |
| Timestamp | `@timestamp` | |

### `logs-nemoclaw.gateway`

Network policy enforcement events from the OpenShell gateway. Security-critical stream — every blocked or approved egress attempt is recorded here with the requesting binary, host, and port. Primary candidate for alerting rules.

| NemoClaw field | ECS mapping | Notes |
|---|---|---|
| Requesting binary | `process.executable` | e.g. `/usr/local/bin/claude`, `/usr/bin/gh` |
| Destination host | `destination.domain` | |
| Destination port | `destination.port` | |
| Policy name matched | `rule.name` | e.g. `claude_code`, `github` |
| Action | `event.action` | `allowed`, `blocked`, `approved` |
| Operator decision | `event.outcome` | For operator-approved requests |
| Timestamp | `@timestamp` | |

### `logs-nemoclaw.inference`

Inference routing events from the OpenShell gateway layer — provider selection, endpoint hit, errors, and routing decisions. Useful for tracking inference failures, provider switches, and timeout patterns separately from general sandbox noise.

| NemoClaw field | ECS mapping | Notes |
|---|---|---|
| Provider name | `labels.inference_provider` | e.g. `nvidia`, `local`, `nim` |
| Model | `labels.model` | e.g. `nvidia/nemotron-3-super-120b-a12b` |
| Endpoint | `url.full` | |
| Outcome | `event.outcome` | `success`, `failure`, `timeout` |
| Error message | `error.message` | Present on failures |
| Sandbox name | `labels.sandbox_name` | |
| Timestamp | `@timestamp` | |

## Dashboard ideas

- **Sandbox activity overview:** Event volume by sandbox name, agent session, and blueprint run over time
- **Egress audit:** Gateway allow/block decisions by destination host, requesting binary, and policy rule — with operator approval events highlighted
- **Inference health:** Inference request outcomes by provider and model; error and timeout rates over time
- **Blueprint lifecycle:** Blueprint apply success/failure rate; time between onboard runs; digest verification failures
- **Policy change tracking:** Dynamic policy updates (`openshell policy set`) correlated with subsequent egress approvals

## Use cases

- **AI agent behavioral monitoring:** Correlate sandbox logs with gateway events to reconstruct what the agent did, what it tried to reach, and what was blocked
- **Egress anomaly detection:** Alert on agent attempts to reach hosts outside the baseline policy, especially from unexpected binaries
- **Inference cost and reliability:** Track inference routing patterns, provider fallbacks, and failure rates across agent sessions
- **Security audit trail:** Complete record of operator approval decisions for compliance or incident review
- **Sandbox lifecycle auditing:** Track blueprint version changes, digest verification failures, and unexpected sandbox recreation events

## References

- [NemoClaw GitHub](https://github.com/NVIDIA/NemoClaw)
- [Architecture](https://docs.nvidia.com/nemoclaw/latest/reference/architecture.html)
- [Network Policies](https://docs.nvidia.com/nemoclaw/latest/reference/network-policies.html)
- [Monitor Sandbox Activity](https://docs.nvidia.com/nemoclaw/latest/monitoring/monitor-sandbox-activity.html)
- [How It Works](https://docs.nvidia.com/nemoclaw/latest/about/how-it-works.html)