[New Integration] Vanta

## 1. Summary
An Elastic integration to collect **audit/event logs** from **Vanta**, the security and compliance automation platform (SOC 2, ISO 27001, HIPAA, GDPR). This brings a full audit trail of administrative and user activity within Vanta into Elastic Security — who changed a control, approved a policy, connected an integration, exported evidence, or modified access — for security monitoring, compliance auditing, and governance reporting.

## 2. Vendor & Product Context
- **Vendor:** Vanta — compliance automation and continuous control monitoring.
- **What it does:** continuously monitors a company's controls, evidence, personnel, and vendors against compliance frameworks.
- **Data source:** Vanta's public REST API, using OAuth-based authentication. Customer creates API credentials in their Vanta admin console (read-only scope).
- **Collection:** the integration polls Vanta's audit-log API on a schedule and forwards events into Elastic.

## 3. Data to Collect
**Vanta event logs** — the audit trail of actions taken within Vanta. Each event records *who* did *what*, *when*, and *to which object* (e.g. a user, policy, control, or connected integration). Events are retained by Vanta for roughly one year and can be collected incrementally.

This is Vanta's own native data — an audit record of activity inside the platform itself — not data mirrored from other connected tools, so it's uniquely valuable and unavailable from any other source.

## 4. Expected Outcomes
- Vanta administrative and user activity searchable and alertable in Elastic Security.
- Events normalized to ECS (actor → `user`, action → `event.action`, timestamp, affected object) so they sit alongside the rest of a customer's security data.
- A prebuilt dashboard and saved searches for auditing Vanta activity out of the box (see §5).
- Foundation for detection rules on sensitive changes (e.g. an integration being disconnected, access granted, or evidence exported).

## 5. Proposed Dashboards
An out-of-the-box **Vanta Audit Activity** dashboard, oriented around compliance/governance auditing:

- **Activity overview** — total events over time, trend line, filterable by date range.
- **Top actors** — which users are most active in Vanta, and what they're doing.
- **Actions breakdown** — events grouped by action type (policy, control, evidence, access, user management, integration changes).
- **Sensitive / high-signal changes** — a focused panel for security-relevant actions: user role/permission changes, integration connect/disconnect, policy approvals, evidence exports, and security-setting changes.
- **Access & administration** — who was granted or removed access, and admin-level configuration changes.
- **Recent activity feed** — a chronological table of the latest events for quick auditing.

## 6. Open Questions & Risks
- How far back Vanta's event-log API allows collection on first run (backfill window) — confirm against a live tenant.
- Access to a **test Vanta tenant with representative data** for development and testing needs to be sourced.
- Modest data volume — this is a governance/audit source, not high-volume security telemetry; position accordingly.

## 7. References
- [Vanta developer docs — authentication](https://developer.vanta.com/docs/concepts/authentication) · [Event logs API](https://developer.vanta.com/api-reference/event-logs/list-event-logs.md) · [API access setup](https://developer.vanta.com/docs/api-access-setup)

Start with the Vanta authentication and Event logs API references linked in the issue, then determine the repository entry point and conventions for a new Elastic integration. Confirm the initial backfill window and test-tenant availability; done means audit events are collected, normalized to ECS, and accompanied by the proposed dashboard and saved searches.

Written by the indexing model from the issue text.