Activity

1. moxarth-rathod

   self-assigned this

   on Jun 9, 2026
2. moxarth-rathod

   added a parent issue on Jun 9, 2026

   • [Epic] Security Integrations | Agentless Support #17973
3. moxarth-rathod

   added

   enhancementNew feature or requestNew feature or request

   Integration:ti_cybersixgillCybersixgillCybersixgill

   Team:Security-Service IntegrationsSecurity Service Integrations team [elastic/security-service-integrations]Security Service Integrations team [elastic/security-service-integrations]

   Team:SDE-CrestCrest developers on the Security Integrations team [elastic/sit-crest-contractors]Crest developers on the Security Integrations team [elastic/sit-crest-contractors]

   on Jun 9, 2026
4. infra-vault-gh-plugin-prod commented on Jun 9, 2026

   

   infra-vault-gh-plugin-prodBot

   on Jun 9, 2026

   More actions

   Pinging @elastic/security-service-integrations (Team:Security-Service Integrations)
5. github-actions commented on Jun 9, 2026

   

   github-actionsBot

   on Jun 9, 2026 – with GitHub Actions

   Contributor

   More actions

   tl;dr: ti_cybersixgill appears to be missing the standard agentless wiring (manifest deployment_modes, agentless docs note, and changelog entry), so I recommend implementing that same pattern used by other TI integrations rather than changing ingestion architecture.

   Recommendation

   Add agentless support to ti_cybersixgill by following the existing TI package pattern:

   1. Add policy_templates[].deployment_modes in packages/ti_cybersixgill/manifest.yml.
   2. Keep httpjson input (peer TI packages support agentless with httpjson; no evidence a cel migration is required).
   3. Add agentless docs section in _dev/build/docs/README.md.
   4. Add changelog entry for “Enable Agentless deployment”.

   I could not read issue bodies/comments (including #19454) due integrity filtering in this runtime, so this recommendation is based on repository evidence and existing merged PR patterns.

   Findings

   • packages/ti_cybersixgill/manifest.yml:13-20 defines policy_templates.inputs but has no deployment_modes block.
   • packages/ti_threatq/manifest.yml:35-43 and packages/ti_rapid7_threat_command/manifest.yml:48-56 both include:
     • deployment_modes.default.enabled: true
     • deployment_modes.agentless.enabled: true
     • release/organization/division/team metadata.
   • packages/ti_rapid7_threat_command/manifest.yml:58 shows this pattern works with httpjson input, so ti_cybersixgill can likely stay httpjson.
   • packages/ti_cybersixgill/_dev/build/docs/README.md:1-15 has no “Agentless Enabled Integration” section, while packages/ti_rapid7_threat_command/_dev/build/docs/README.md:7-10 has the standard agentless text block.
   • packages/ti_cybersixgill/changelog.yml:1-6 has no agentless entry; packages/ti_rapid7_threat_command/changelog.yml:13-16 includes “Enable Agentless deployment.”
   • Relevant merged PR precedent: #18331 (“[ti_rapid7_threat_command] Add Agentless Deployment”) and #18552 (agentless release field rollout).

   Verification

   I ran a direct manifest comparison to confirm current wiring:

   $ nl -ba packages/ti_cybersixgill/manifest.yml | sed -n '1,40p'
   $ nl -ba packages/ti_threatq/manifest.yml | sed -n '30,55p'
   $ nl -ba packages/ti_rapid7_threat_command/manifest.yml | sed -n '44,62p'

   Observed output (excerpt):

   == ti_cybersixgill manifest ==
   13  policy_templates:
   17      inputs:
   18        - type: httpjson
   
   == ti_threatq manifest ==
   35      deployment_modes:
   36        default:
   38        agentless:
   40          release: beta
   
   == ti_rapid7_threat_command manifest ==
   48      deployment_modes:
   51        agentless:
   53          release: beta
   57      inputs:
   58        - type: httpjson
   

   Detailed Action Plan

   1. Update packages/ti_cybersixgill/manifest.yml:
      • Under policy_templates[0] (currently around lines 13-20), add:
        • deployment_modes.default.enabled: true
        • deployment_modes.agentless.enabled: true
        • deployment_modes.agentless.release: beta
        • organization/division/team metadata matching TI ownership conventions used in ti_threatq and ti_rapid7_threat_command.
   2. Keep policy_templates.inputs[0].type: httpjson unless product requirements explicitly demand cel.
   3. Update packages/ti_cybersixgill/_dev/build/docs/README.md:
      • Add the same “## Agentless Enabled Integration” section used in other agentless TI integrations (e.g. ti_rapid7_threat_command).
   4. Rebuild docs (elastic-package build) so rendered docs are updated from _dev/build/docs/README.md.
   5. Add a top changelog entry in packages/ti_cybersixgill/changelog.yml (enhancement) for enabling agentless deployment.
   6. Validate package checks/tests for packages/ti_cybersixgill with existing repo workflows before merge.

   Related Items

   Type	Link	Relevance
   Issue	#19454	Requested work item (ti_cybersixgill agentless support)
   PR	#18331	Concrete TI package precedent for enabling agentless deployment
   PR	#18552	Introduces deployment_modes.agentless.release semantics used across packages
   File	packages/ti_cybersixgill/manifest.yml	Missing deployment_modes in current package
   File	packages/ti_cybersixgill/_dev/build/docs/README.md	Missing agentless docs section
   File	packages/ti_cybersixgill/changelog.yml	Needs agentless change entry
   File	packages/ti_threatq/manifest.yml	Agentless + httpjson reference pattern
   File	packages/ti_rapid7_threat_command/manifest.yml	Agentless + httpjson + release metadata reference

   Note

   🔒 Integrity filter blocked 7 items

   The following items were blocked because they don't meet the GitHub integrity level.

   • #19454 issue_read: has lower integrity than agent requires. The agent cannot read data with integrity below "approved".
   • #19454 search_issues: has lower integrity than agent requires. The agent cannot read data with integrity below "approved".
   • #17973 search_issues: has lower integrity than agent requires. The agent cannot read data with integrity below "approved".
   • #17560 search_pull_requests: has lower integrity than agent requires. The agent cannot read data with integrity below "approved".
   • #11203 search_pull_requests: has lower integrity than agent requires. The agent cannot read data with integrity below "approved".
   • #18294 issue_read: has lower integrity than agent requires. The agent cannot read data with integrity below "approved".
   • #17537 issue_read: has lower integrity than agent requires. The agent cannot read data with integrity below "approved".

   To allow these resources, lower min-integrity in your GitHub frontmatter:

   tools:
     github:
       min-integrity: approved  # merged | approved | unapproved | none

   ---

   What is this? | From workflow: Issue Triage

   Give us feedback! React with 🚀 if perfect, 👍 if helpful, 👎 if not.
6. moxarth-rathod

   closed this as completedin #19534on Jun 17, 2026