[darktrace] Add Agentless Deployment Support

[moxarth-rathod]

Description

Add agentless support to the darktrace.

Requirements

Following the established Phase I pattern, for each integration see the Onboarding Integration Guide.

1. Technical implementation

• Update integration manifest.yml to enable agentless deployment mode ()
• Update integration documentation with agentless deployment instructions
• Update changelog.md

Example reference: #13367

2. Performance documentation

• Test and document throughput in agentless (requires access to vendor environment and/or sample data)
• Document specific metrics for each integration. For example/where possible:
  • API response time: Average time for vendor API calls to complete
  • Events processed per minute: How many log entries/events the integration can handle
  • Error rates: Percentage of failed API calls or data processing errors
  • Container resource usage: CPU and memory consumption under typical load
  • Vendor-specific limits: Rate limiting thresholds and API quotas

Example documentation format: "Crowdstrike Falcon Intelligence: 200ms avg API response, 5,000 events/min, 0.1% error rate, 512MB RAM/0.5CPU, 1000 API calls/hour limit"

Dependencies

• Agentless infrastructure GA readiness (still in beta)
• Input compatibility: Currently agentless is optimized for httpjson and cel inputs
• UX enhancement: Add agentless deployment filter/toggle to integrations catalog page for better discoverability

[infra-vault-gh-plugin-prod]

Pinging @elastic/security-service-integrations (Team:Security-Service Integrations)

[github-actions]

tl;dr: darktrace does not currently expose agentless deployment at the package policy-template level, so this issue is a valid enhancement; the shortest path is to add deployment_modes.agentless in packages/darktrace/manifest.yml and scope agentless support to API-capable streams first.

Recommendation

Add agentless wiring in packages/darktrace/manifest.yml (policy template), then validate stream compatibility so agentless only enables supported collection paths (API-based streams first). Keep syslog listener paths (tcp/udp) non-agentless unless/until they are explicitly supported in agentless architecture.

Findings

1. Darktrace package is currently agent-based and lacks agentless deployment wiring.

   • packages/darktrace/manifest.yml:5 → description: Collect logs from Darktrace with Elastic Agent.
   • packages/darktrace/manifest.yml:23-30 → policy_templates has inputs, but no deployment_modes block.

2. Reference packages that support agentless define deployment_modes under the policy template.

   • packages/prisma_cloud/manifest.yml:55-62 includes:
     • deployment_modes.default.enabled: true
     • deployment_modes.agentless.enabled: true (+ org/division/team metadata)
   • packages/okta/manifest.yml:25-32 shows the same structure.

3. Darktrace data streams are mixed transport; only two include API input.

   • API + syslog mixed:
     • packages/darktrace/data_stream/ai_analyst_alert/manifest.yml:4,66,124 (httpjson, tcp, udp)
     • packages/darktrace/data_stream/model_breach_alert/manifest.yml:4,66,124 (httpjson, tcp, udp)
   • Syslog-only:
     • packages/darktrace/data_stream/system_status_alert/manifest.yml:4,62 (tcp, udp only)
   • Docs confirm API limitation:
     • packages/darktrace/docs/README.md:36 → System Status Alert are not supported by REST API.

4. Related GitHub history could not be fully read due integrity filtering in this run.

   • Filtered when queried: #18930, #17973, #18803, and PR #11203.

Verification

I ran targeted repository checks to confirm the current state:

$ grep -n "deployment_modes:" packages/darktrace/manifest.yml

$ grep -n "deployment_modes:" packages/prisma_cloud/manifest.yml
55:    deployment_modes:

$ grep -n "with Elastic Agent" packages/darktrace/manifest.yml
5:description: Collect logs from Darktrace with Elastic Agent.

$ grep -nE "System Status Alert are not supported by REST API|Elastic Agent that is running the integration" packages/darktrace/docs/README.md
36:**Note:** System Status Alert are not supported by REST API.
47:4. Enter the **IP Address**  and **Port** of the Elastic Agent that is running the integration in the **Server** and **Server Port** field respectively.

$ grep -n "^  - input: " packages/darktrace/data_stream/ai_analyst_alert/manifest.yml packages/darktrace/data_stream/model_breach_alert/manifest.yml packages/darktrace/data_stream/system_status_alert/manifest.yml
packages/darktrace/data_stream/ai_analyst_alert/manifest.yml:4:  - input: httpjson
packages/darktrace/data_stream/ai_analyst_alert/manifest.yml:66:  - input: tcp
packages/darktrace/data_stream/ai_analyst_alert/manifest.yml:124:  - input: udp
packages/darktrace/data_stream/model_breach_alert/manifest.yml:4:  - input: httpjson
packages/darktrace/data_stream/model_breach_alert/manifest.yml:66:  - input: tcp
packages/darktrace/data_stream/model_breach_alert/manifest.yml:124:  - input: udp
packages/darktrace/data_stream/system_status_alert/manifest.yml:4:  - input: tcp
packages/darktrace/data_stream/system_status_alert/manifest.yml:62:  - input: udp

Detailed Action Plan

1. Update packages/darktrace/manifest.yml policy template (~23+) to add:

   • deployment_modes.default.enabled: true
   • deployment_modes.agentless.enabled: true
   • organization/division/team metadata matching repo conventions (see packages/prisma_cloud/manifest.yml:55-62, packages/okta/manifest.yml:25-32).

2. Define stream behavior for agentless compatibility:

   • Keep API (httpjson) paths enabled for ai_analyst_alert and model_breach_alert.
   • Explicitly handle syslog listener streams (tcp/udp) so agentless users are not presented unsupported paths.
   • Review:
     • packages/darktrace/data_stream/ai_analyst_alert/manifest.yml
     • packages/darktrace/data_stream/model_breach_alert/manifest.yml
     • packages/darktrace/data_stream/system_status_alert/manifest.yml

3. Align docs with deployment behavior:

   • Update packages/darktrace/docs/README.md setup guidance around API-vs-syslog and agentless usage, preserving note that System Status Alert is not REST-backed (line 36).

4. Validate package policy rendering and stream availability in Fleet after manifest changes.

Related Items

Type	Link	Relevance
Issue	#18930	Request being triaged
Issue	#17973	Potentially related; content filtered in this run
Issue	#18803	Potentially related; content filtered in this run
PR	#11203	Potentially related; content filtered in this run
File	packages/darktrace/manifest.yml:23-30	Missing deployment_modes in policy template
File	packages/prisma_cloud/manifest.yml:55-62	Canonical agentless deployment-mode structure
File	packages/okta/manifest.yml:25-32	Additional agentless deployment-mode example
File	packages/darktrace/docs/README.md:36,47	API limitation + agent-oriented syslog setup wording

Note

🔒 Integrity filter blocked 9 items

The following items were blocked because they don't meet the GitHub integrity level.

• #18930 issue_read: has lower integrity than agent requires. The agent cannot read data with integrity below "approved".
• #18930 search_issues: has lower integrity than agent requires. The agent cannot read data with integrity below "approved".
• #17973 search_issues: has lower integrity than agent requires. The agent cannot read data with integrity below "approved".
• #17560 search_pull_requests: has lower integrity than agent requires. The agent cannot read data with integrity below "approved".
• #13085 search_pull_requests: has lower integrity than agent requires. The agent cannot read data with integrity below "approved".
• #11203 search_pull_requests: has lower integrity than agent requires. The agent cannot read data with integrity below "approved".
• #18803 search_issues: has lower integrity than agent requires. The agent cannot read data with integrity below "approved".
• #18803 issue_read: has lower integrity than agent requires. The agent cannot read data with integrity below "approved".
• #17973 issue_read: has lower integrity than agent requires. The agent cannot read data with integrity below "approved".

To allow these resources, lower min-integrity in your GitHub frontmatter:

tools:
  github:
    min-integrity: approved  # merged | approved | unapproved | none

---

What is this? | From workflow: Issue Triage

Give us feedback! React with 🚀 if perfect, 👍 if helpful, 👎 if not.