[dashboard-data-scope] High-severity unscoped data source in aws_cloudtrail_otel dashboard

## Findings

### 1. `aws_cloudtrail_otel` dashboard queries global `logs*` instead of CloudTrail-scoped data

**Location**
- `packages/aws_cloudtrail_otel/kibana/dashboard/aws_cloudtrail_otel-9bfbe31c-e775-4ee4-9e34-a449e603d109.json:147`
- `packages/aws_cloudtrail_otel/kibana/dashboard/aws_cloudtrail_otel-9bfbe31c-e775-4ee4-9e34-a449e603d109.json:163`
- Additional occurrences: 21 `FROM logs*` queries in this same dashboard file.

**Evidence**
- Example query in Lens state:
- `"esql": "FROM logs*\n| EVAL outcome = CASE(aws.error.code IS NOT NULL, \"Fail\", \"Success\") ..."`
- Package dataset declaration:
- `packages/aws_cloudtrail_otel/manifest.yml:22` → `name: aws.cloudtrail.otel`

**What is wrong**
The dashboard’s effective data source is global (`logs*`), so panel queries read all logs indices instead of only `aws.cloudtrail.otel` documents.

**Why it matters**
Any user with multiple integrations installed will see cross-integration data mixed into CloudTrail panels (top values, counts, distributions), making dashboard filters/results unreliable for CloudTrail analysis.

**Suggested fix**
Scope all dashboard queries and data-view references to the package dataset, e.g. `logs-aws.cloudtrail.otel-*` (or the package’s canonical scoped data view ID), and regenerate/re-export the dashboard so references are consistently scoped.

### 2. Same dashboard contains an unresolved static `index-pattern` reference for the global filter

**Location**
- `packages/aws_cloudtrail_otel/kibana/dashboard/aws_cloudtrail_otel-9bfbe31c-e775-4ee4-9e34-a449e603d109.json:27`
- `packages/aws_cloudtrail_otel/kibana/dashboard/aws_cloudtrail_otel-9bfbe31c-e775-4ee4-9e34-a449e603d109.json:1254`

**Evidence**
- Filter metadata uses `indexRefName: "kibanaSavedObjectMeta.searchSourceJSON.filter[0].meta.index"`.
- The linked reference ID is hardcoded UUID `56b40a51-690a-4354-8659-66a579d2b184` of type `index-pattern`.
- That UUID appears only in the references block within this dashboard asset and is not installed as a package data view asset.

**What is wrong**
The dashboard-level filter reference points to a static `index-pattern` ID that is not provisioned by this package.

**Why it matters**
This can break filter/data-view resolution on install, compounding the scope issue and creating user-visible dashboard filter errors.

**Suggested fix**
Replace static `index-pattern` UUID wiring with package-scoped dynamic data-view references generated by package tooling.

## Coverage
- Total dashboards scanned: **1292**
- Dashboards with confirmed high-severity findings in this report: **1**

## Suggested Actions
- [ ] Replace all `FROM logs*` sources in `aws_cloudtrail_otel-9bfbe31c-e775-4ee4-9e34-a449e603d109.json` with package-scoped sources.
- [ ] Re-export the dashboard so global filter references no longer use unresolved static `index-pattern` UUIDs.
- [ ] Add/enable validator coverage (including SVR00002 scope checks) for this package to prevent recurrence.

> [!NOTE]
>
> 🔒 Integrity filter blocked 3 items
>
> The following items were blocked because they don't meet the GitHub integrity level.
>
> - [#18610](https://github.com/elastic/integrations/issues/18610) `search_issues`: has lower integrity than agent requires. The agent cannot read data with integrity below "approved".
> - [#17816](https://github.com/elastic/integrations/issues/17816) `search_issues`: has lower integrity than agent requires. The agent cannot read data with integrity below "approved".
> - [#16427](https://github.com/elastic/integrations/issues/16427) `search_issues`: has lower integrity than agent requires. The agent cannot read data with integrity below "approved".
>
> To allow these resources, lower `min-integrity` in your GitHub frontmatter:
>
> ```yaml
> tools:
> github:
> min-integrity: approved # merged | approved | unapproved | none
> ```
>
>

---
[What is this?](https://ela.st/github-ai-tools) | [From workflow: Sweeper: Dashboard Data Scope and Filter Integrity](https://github.com/elastic/integrations/actions/runs/26569187209)

Give us feedback! React with 🚀 if perfect, 👍 if helpful, 👎 if not.
> - [x] expires on Jun 4, 2026, 10:38 AM UTC