Activity

1. mohitjha-elastic

   self-assigned this

   on May 20, 2026
2. mohitjha-elastic

   added a parent issue on May 20, 2026

   • [Epic] Security Integrations | Agentless Support #17973
3. mohitjha-elastic

   added

   enhancementNew feature or requestNew feature or request

   Integration:forgerockForgeRockForgeRock

   Team:Security-Service IntegrationsSecurity Service Integrations team [elastic/security-service-integrations]Security Service Integrations team [elastic/security-service-integrations]

   Team:SDE-CrestCrest developers on the Security Integrations team [elastic/sit-crest-contractors]Crest developers on the Security Integrations team [elastic/sit-crest-contractors]

   on May 20, 2026
4. infra-vault-gh-plugin-prod commented on May 20, 2026

   

   infra-vault-gh-plugin-prodBot

   on May 20, 2026

   More actions

   Pinging @elastic/security-service-integrations (Team:Security-Service Integrations)
5. github-actions commented on May 20, 2026

   

   github-actionsBot

   on May 20, 2026 – with GitHub Actions

   Contributor

   More actions

   tl;dr: This issue is actionable now for Phase I (manifest + docs + changelog), but performance metrics cannot be completed in-repo without vendor/agentless runtime access.

   Recommendation

   Proceed with a single implementation PR that adds ForgeRock agentless support using the established pattern, and split performance benchmarking into a follow-up task dependent on environment access.

   Findings

   1. ForgeRock currently has no agentless deployment mode configured.
      • packages/forgerock/manifest.yml:16-23 shows one policy template and type: httpjson, but no deployment_modes block.
   2. The team pattern for Phase I agentless support is consistent across security-service integrations.
      • packages/okta/manifest.yml:25-34 and packages/darktrace/manifest.yml:27-36 add:
        • deployment_modes.default.enabled: true
        • deployment_modes.agentless.enabled: true
        • organization/division/team metadata (security / engineering / security-service-integrations)
   3. Agentless docs section is standardized and inserted near the top of README docs.
      • packages/okta/docs/README.md:5-9
      • packages/cisco_duo/docs/README.md:5-9
   4. Changelog pattern is minor-version enhancement entry at top.
      • ForgeRock currently: packages/forgerock/changelog.yml:1-6 (latest 1.22.0)
      • Reference PR in issue body: #13367 used this exact approach for AWS Security Hub.
   5. Important compatibility note: ForgeRock is format_version: "3.0.2" (packages/forgerock/manifest.yml:6), while manifests containing deployment_modes in this repo are at 3.2.3+ (repo scan found 91 such packages, minimum observed 3.2.3).

   Verification

   I ran local checks to confirm current ForgeRock state and implementation constraints:

   $ grep -n "deployment_modes" packages/forgerock/manifest.yml
   # (no output)
   
   $ grep -n "type: httpjson" packages/forgerock/manifest.yml
   21:      - type: httpjson
   
   $ sed -n "16,30p" packages/forgerock/manifest.yml
   policy_templates:
     - name: forgerock
       title: Collect ForgeRock logs via API
       description: Collecting ForgeRock logs via API with Elastic Agent.
       inputs:
         - type: httpjson
         ...
   
   $ sed -n "1,18p" packages/forgerock/docs/README.md
   # ForgeRock Identity Platform
   ...
   ### Configuration
   ...
   ## Logs
   
   $ sed -n "1,12p" packages/forgerock/changelog.yml
   # newer versions go on top
   - version: "1.22.0"
     changes:
       - description: Prevent updating fleet health status to degraded.
         type: enhancement
         link: https://github.com/elastic/integrations/pull/15584
   
   $ grep -n "deployment_modes\|type: httpjson" packages/okta/manifest.yml | head
   25:    deployment_modes:
   34:      - type: httpjson
   
   $ grep -n "deployment_modes\|type: httpjson" packages/darktrace/manifest.yml | head
   27:    deployment_modes:
   36:      - type: httpjson

   Environment limitation during triage:

   • Parent issue #17973 is currently not readable from this workflow context (integrity restriction).
   • elastic-package/mage are not available in this runner path, so package-level test execution was not performed here.

   Detailed Action Plan

   1. Manifest update (primary implementation)

      • File: packages/forgerock/manifest.yml
      • Insert under policy_templates[0] (between current description and inputs, around :19-21):

        deployment_modes:
          default:
            enabled: true
          agentless:
            enabled: true
            organization: security
            division: engineering
            team: security-service-integrations

   2. Format version alignment

      • Same file: packages/forgerock/manifest.yml:6
      • Update format_version to a version that supports deployment_modes (minimum observed in-repo for this field is 3.2.3; many packages are on 3.3.2).

   3. Docs update

      • File: packages/forgerock/docs/README.md
      • Add standard "Agentless Enabled Integration" block near the top (same placement/pattern as Okta/Cisco Duo), before ### Configuration.

   4. Changelog update

      • File: packages/forgerock/changelog.yml
      • Add a new top entry with minor bump (e.g., 1.23.0) and type: enhancement, linking the PR implementing agentless support.

   5. Follow-up (separate, dependency-bound)

      • Performance metrics from the issue (API response time, events/min, error rates, resource usage, vendor limits) should be tracked in a follow-up task requiring vendor/runtime access.

   Related Items

   Type	Link	Relevance
   Issue	#19092	Current request
   PR	#13367	Referenced Phase I agentless implementation pattern
   File	packages/forgerock/manifest.yml:6,16-23	Current ForgeRock policy template/input and format version
   File	packages/forgerock/docs/README.md:1-9	No agentless section yet
   File	packages/forgerock/changelog.yml:1-6	Current latest version entry
   File	packages/okta/manifest.yml:25-34	httpjson + deployment_modes example
   File	packages/darktrace/manifest.yml:27-36	httpjson + deployment_modes example
   File	packages/okta/docs/README.md:5-9	Standard agentless docs text/placement
   File	packages/cisco_duo/docs/README.md:5-9	Standard agentless docs text/placement
   Issue	#17973	Parent tracker referenced by #19092 (not readable in this workflow context)

   Note

   🔒 Integrity filter blocked 15 items

   The following items were blocked because they don't meet the GitHub integrity level.

   • #17973 search_issues: has lower integrity than agent requires. The agent cannot read data with integrity below "approved".
   • #18803 search_issues: has lower integrity than agent requires. The agent cannot read data with integrity below "approved".
   • #18881 search_pull_requests: has lower integrity than agent requires. The agent cannot read data with integrity below "approved".
   • #15988 search_pull_requests: has lower integrity than agent requires. The agent cannot read data with integrity below "approved".
   • #17560 search_pull_requests: has lower integrity than agent requires. The agent cannot read data with integrity below "approved".
   • #11203 search_pull_requests: has lower integrity than agent requires. The agent cannot read data with integrity below "approved".
   • forgerock: dashboard does not properly filter documents to be specific for ForgeRock data #14309 list_issues: has lower integrity than agent requires. The agent cannot read data with integrity below "approved".
   • [forgerock]: Logs being pulled for wrong date time range #11331 list_issues: has lower integrity than agent requires. The agent cannot read data with integrity below "approved".
   • forgerock: add a specific endpoint emulator for sytem tests #11250 list_issues: has lower integrity than agent requires. The agent cannot read data with integrity below "approved".
   • [forgerock]: agent does not keep time stamp ranges within API requirements #11220 list_issues: has lower integrity than agent requires. The agent cannot read data with integrity below "approved".
   • [ForgeRock] Add idm_recon events #9637 list_issues: has lower integrity than agent requires. The agent cannot read data with integrity below "approved".
   • [Epic] Security Integrations | Agentless Support #17973 list_issues: has lower integrity than agent requires. The agent cannot read data with integrity below "approved".
   • [ManyVarious]: Expose Http-json input settings to integrations that depend on it. #12182 list_issues: has lower integrity than agent requires. The agent cannot read data with integrity below "approved".
   • sei: packages potentially using incorrect mustache snippet escaping #7641 list_issues: has lower integrity than agent requires. The agent cannot read data with integrity below "approved".
   • #17973 issue_read: has lower integrity than agent requires. The agent cannot read data with integrity below "approved".

   To allow these resources, lower min-integrity in your GitHub frontmatter:

   tools:
     github:
       min-integrity: approved  # merged | approved | unapproved | none

   ---

   What is this? | From workflow: Issue Triage

   Give us feedback! React with 🚀 if perfect, 👍 if helpful, 👎 if not.
6. mohitjha-elastic

   closed this as completedin #19205on Jun 1, 2026