[New Integration] OneLogin

## 1. Summary
Collect authentication and audit events from OneLogin into Elastic Security. OneLogin is a cloud identity and access management (SSO/MFA) provider; this integration brings its event log — logins and login failures, MFA activity, user and role changes, and admin actions — into Elastic, with OneLogin's risk scoring carried on each event. Core identity telemetry for detecting account attacks, privilege changes, and risky access.

## 2. Vendor and product
OneLogin (part of One Identity) provides SSO, MFA, and directory/identity management. Its REST API exposes a first-class events log plus identity inventory.

- **Transport:** the OneLogin Events API. The integration polls on a schedule and reads new events with a cursor, resuming cleanly.
- **Auth:** OAuth2 client credentials — a client ID and secret generated in the OneLogin admin console, exchanged for a bearer token.
- **Deployment:** built on CEL as an API pull, so it can run agentless — no Elastic Agent to deploy. The customer's region and subdomain are config options.
- **Real-time option:** OneLogin can also push events to an HTTP endpoint (Event Broadcaster); the polling API is the reliable default, with webhook receipt as an optional mode.

## 3. Data
- **Events** — the core. The OneLogin audit and security log: authentication (login success and failure, logout), MFA and OTP activity, user lifecycle (created, updated, activated, suspended, deleted), role and privilege changes, app access and provisioning, and admin/config actions. Each event carries the acting and affected user, source IP, app, and OneLogin's Vigilance risk score and reasons. Event types are enriched from OneLogin's type dictionary into readable actions.

Optional context streams follow: **users**, **roles**, and **apps** inventory for identity enrichment.

## 4. What we get
OneLogin identity events in Elastic, mapped to ECS and joinable to the same users and activity across a customer's other data — so a suspicious OneLogin login ties to what that user did elsewhere. Strong for detecting credential attacks (brute force, password spraying, impossible travel), MFA abuse, privilege escalation, and risky logins flagged by Vigilance, plus tracking user provisioning and admin changes. Comes with dashboards and detection rules for those cases, and feeds user-entity context for identity analytics.

## 5. Dashboards
An authentication and access overview:
- logins and failures over time, by user, app, and source IP/geo
- MFA activity and failures
- high-risk events by Vigilance risk score

An identity and admin activity view:
- user lifecycle — created, activated, suspended, deleted
- role and privilege changes
- app assignments and provisioning
- a recent-events table for review

## 6. References
- [OneLogin developer overview](https://developers.onelogin.com/api-docs/1/getting-started/dev-overview)
- [Events API](https://developers.onelogin.com/api-docs/1/events/get-events)
- [OAuth tokens](https://developers.onelogin.com/api-docs/1/oauth20-tokens/generate-tokens-2)

Start with the OneLogin Events API and OAuth token references, confirming cursor-based polling, regional endpoints, and client-credentials authentication. Define the integration around the events stream first, then assess the optional users, roles, apps, and Event Broadcaster modes. Done means events and risk data are mapped to ECS, with the described dashboards and detection rules.

Written by the indexing model from the issue text.