[New Integration] TeamViewer

## 1. Summary
Collect remote-session records and audit activity from TeamViewer into Elastic Security. TeamViewer is a remote access and support platform; this integration brings visibility into who remotely connected to which device and when, plus administrative and session activity from the TeamViewer management console — high-value telemetry for detecting unauthorized or unusual remote access.

## 2. Vendor and product
TeamViewer provides remote control, remote support, and unattended access to devices across an organization. Its management layer exposes a REST API covering session reports, an audit event log, users, and devices.

- **Transport:** the TeamViewer REST API. The integration polls on a schedule; nothing needs to be opened inbound.
- **Auth:** a script token generated in the TeamViewer console with read scopes for connection reporting and the event log. The customer supplies the token.
- **Deployment:** built on CEL as an API pull against TeamViewer's single global endpoint, so it can run agentless — no Elastic Agent to deploy.
- **Note:** API access requires a paid TeamViewer plan, and the full audit log requires an admin-level token.

## 3. Data
Two typed data streams carry the security value:

- **Connection reports** — one record per remote-control session: the user who connected, the target device and group, start and end time, duration, and session code. This is the core "who remoted into what" data. (Records are written after a session ends, so there's a short delay; collection keys off session start time.)
- **Event / audit log** — management console activity: session lifecycle (started, ended, participants joining), file transfers and recordings during sessions, and administrative changes (users created or deleted, permission and policy changes, conditional-access rules, script tokens, two-factor changes).

Two more streams add context and follow: **users** (company user list, roles, last access) and **devices** (managed device inventory).

## 4. What we get
TeamViewer remote-access activity in Elastic, mapped to ECS and joinable to the same users, devices, and endpoint activity already there — so a remote session can be tied to what happened on the machine during and after it. The strongest uses are detecting unusual remote access (off-hours sessions, unfamiliar users, sensitive devices), spotting file transfers or recordings within sessions, and tracking admin changes to the TeamViewer environment. Comes with dashboards and detection rules for those cases.

## 5. Dashboards
A remote-access overview:
- sessions over time, with off-hours highlighted
- top users initiating sessions and top target devices
- session durations and long-running sessions
- file transfers and recordings within sessions

An audit activity view:
- admin changes over time — users, permissions, policies, conditional access
- two-factor and script-token changes
- a recent-events table for review

## 6. References
- [Use the TeamViewer API](https://www.teamviewer.com/en/global/support/knowledge-base/teamviewer-remote/for-developers/use-the-teamviewer-api/)
- [API reference (Swagger)](https://webapi.teamviewer.com/api/v1/docs/index)
- [Auditability / Event Log](https://www.teamviewer.com/en-us/global/support/knowledge-base/teamviewer-tensor/security/auditability-event-log/)

Start with the TeamViewer REST API reference and the auditability/event-log documentation linked in the issue; verify authentication, connection reports, audit events, users, and devices. Done means collecting the four proposed streams through CEL, mapping them to ECS, and providing the stated dashboards and detection rules.

Written by the indexing model from the issue text.