Activity

1. mohitjha-elastic

   self-assigned this

   on Jun 10, 2026
2. mohitjha-elastic

   added a parent issue on Jun 10, 2026

   • [Epic] Security Integrations | Agentless Support #17973
3. mohitjha-elastic

   added

   enhancementNew feature or requestNew feature or request

   Team:Security-Service IntegrationsSecurity Service Integrations team [elastic/security-service-integrations]Security Service Integrations team [elastic/security-service-integrations]

   Team:SDE-CrestCrest developers on the Security Integrations team [elastic/sit-crest-contractors]Crest developers on the Security Integrations team [elastic/sit-crest-contractors]

   Integration:ti_domaintoolsDomainTools Feeds (Partner supported)DomainTools Feeds (Partner supported)

   on Jun 10, 2026
4. infra-vault-gh-plugin-prod commented on Jun 10, 2026

   

   infra-vault-gh-plugin-prodBot

   on Jun 10, 2026

   More actions

   Pinging @elastic/security-service-integrations (Team:Security-Service Integrations)
5. github-actions commented on Jun 10, 2026

   

   github-actionsBot

   on Jun 10, 2026 – with GitHub Actions

   Contributor

   More actions

   tl;dr: ti_domaintools is missing the policy-template deployment_modes.agentless metadata, so Fleet cannot expose agentless deployment yet; the safest implementation path is to mirror the ti_anomali/ti_flashpoint pattern (manifest + docs + changelog, and likely Kibana floor alignment).

   Recommendation

   Add agentless support in ti_domaintools by following the same rollout pattern already used in TI integrations:

   1. Add deployment_modes (default.enabled: true + agentless.enabled: true with owner metadata and release: beta) under policy_templates in packages/ti_domaintools/manifest.yml.
   2. Add deployment guidance in packages/ti_domaintools/_dev/build/docs/README.md (agentless + agent-based sections), then regenerate rendered docs.
   3. Add a changelog entry in packages/ti_domaintools/changelog.yml.
   4. Confirm whether Kibana minimum must be raised to ^8.18.0 for this package (as happened in prior TI agentless rollout).

   Findings

   • packages/ti_domaintools/manifest.yml:27-34 defines only inputs and has no deployment mode block:

   policy_templates:
     - name: domaintools
       ...
       inputs:
         - type: cel

   • packages/ti_anomali/manifest.yml:43-51 already has agentless metadata:

   deployment_modes:
     default:
       enabled: true
     agentless:
       enabled: true
       release: beta
       organization: security
       division: engineering
       team: security-service-integrations

   • packages/ti_flashpoint/manifest.yml:37-45 uses the same structure.
   • packages/ti_domaintools/_dev/build/docs/README.md:1-113 has no "How do I deploy this integration?" section.
   • packages/ti_anomali/docs/README.md:51-61 includes explicit deployment guidance (Agentless-based installation / Agent-based installation).
   • Prior art shows follow-up fixes were needed after initial enablement:
     • PR #14547 (initial ti_anomali agentless enablement)
     • PR #17253 (fixes incl. Kibana constraint update)
     • PR #18552 (agentless.release field rollout)

   Note: I could not read the full issue body via MCP due an integrity restriction, so findings are based on repository state + related merged PRs.

   Verification

   I ran local checks to confirm current state:

   $ grep -n "deployment_modes" packages/ti_domaintools/manifest.yml
   # (no output)
   
   $ grep -n "deployment_modes\|agentless" packages/ti_anomali/manifest.yml
   43:    deployment_modes:
   46:      agentless:
   
   $ grep -n "How do I deploy this integration\|Agentless-based installation" packages/ti_anomali/docs/README.md
   51:## How do I deploy this integration?
   55:### Agentless-based installation

   Detailed Action Plan

   1. Enable deployment modes in package manifest

      • Edit packages/ti_domaintools/manifest.yml under policy_templates[0] (around lines 27-34).
      • Add deployment_modes block matching current conventions used in ti_anomali and ti_flashpoint.

   2. Validate Kibana constraint compatibility for agentless

      • Review packages/ti_domaintools/manifest.yml:14 (^8.16.0 || ^9.0.0) against current agentless requirements.
      • If required, bump floor to ^8.18.0 || ^9.0.0 (same adjustment made in ti_anomali via #17253).

   3. Update docs source and rendered output

      • Add a deployment section in packages/ti_domaintools/_dev/build/docs/README.md (near requirements/setup), modeled after:
        • packages/ti_anomali/docs/README.md:51-61
        • packages/ti_flashpoint/docs/README.md:57-69
      • Regenerate rendered docs so packages/ti_domaintools/docs/README.md stays in sync.

   4. Record change in changelog

      • Add top entry in packages/ti_domaintools/changelog.yml describing agentless mode support and release level.

   5. Run package validation/tests used for TI packages

      • Build/lint/test package to confirm schema and docs rendering pass and Fleet UI metadata is accepted.

   Related Items

   Type	Link	Relevance
   PR	#14547	First TI agentless rollout (ti_anomali)
   PR	#17253	Follow-up fixes after agentless rollout (incl. Kibana constraint note)
   PR	#18552	Added agentless.release metadata across integrations
   File	packages/ti_domaintools/manifest.yml:27-34	Missing deployment_modes block
   File	packages/ti_domaintools/_dev/build/docs/README.md:1-113	No deployment-mode guidance yet
   File	packages/ti_anomali/manifest.yml:43-51	Reference implementation for deployment modes
   File	packages/ti_flashpoint/manifest.yml:37-45	Second reference implementation for deployment modes
   File	packages/ti_anomali/changelog.yml:65-67	Historical "Added Agentless deployment mode" entry
   File	packages/ti_anomali/changelog.yml:55-57	Historical Kibana-floor follow-up for agentless

   Note

   🔒 Integrity filter blocked 31 items

   The following items were blocked because they don't meet the GitHub integrity level.

   • #19475 issue_read: has lower integrity than agent requires. The agent cannot read data with integrity below "approved".
   • #19475 search_issues: has lower integrity than agent requires. The agent cannot read data with integrity below "approved".
   • #17973 search_issues: has lower integrity than agent requires. The agent cannot read data with integrity below "approved".
   • #18881 search_pull_requests: has lower integrity than agent requires. The agent cannot read data with integrity below "approved".
   • #15988 search_pull_requests: has lower integrity than agent requires. The agent cannot read data with integrity below "approved".
   • #17560 search_pull_requests: has lower integrity than agent requires. The agent cannot read data with integrity below "approved".
   • [ti_maltiverse] Add Agentless Deployment Support #19478 list_issues: has lower integrity than agent requires. The agent cannot read data with integrity below "approved".
   • [ti_eset] Add Agentless Deployment Support #19477 list_issues: has lower integrity than agent requires. The agent cannot read data with integrity below "approved".
   • [ti_eclecticiq] Add Agentless Deployment Support #19476 list_issues: has lower integrity than agent requires. The agent cannot read data with integrity below "approved".
   • [ti_domaintools] Add Agentless Deployment Support #19475 list_issues: has lower integrity than agent requires. The agent cannot read data with integrity below "approved".
   • [Serverless security] [otlp_input_otel] Failing test daily: policy test: test-auth-oidc.yml in otlp_input_otel. #19474 list_issues: has lower integrity than agent requires. The agent cannot read data with integrity below "approved".
   • [Serverless security] [otlp_input_otel] Failing test daily: policy test: test-auth-multi.yml in otlp_input_otel. #19473 list_issues: has lower integrity than agent requires. The agent cannot read data with integrity below "approved".
   • [Serverless security] [otlp_input_otel] Failing test daily: policy test: test-auth-bearer.yml in otlp_input_otel. #19472 list_issues: has lower integrity than agent requires. The agent cannot read data with integrity below "approved".
   • [Serverless security] [otlp_input_otel] Failing test daily: policy test: test-auth-basic.yml in otlp_input_otel. #19471 list_issues: has lower integrity than agent requires. The agent cannot read data with integrity below "approved".
   • [sysdig] convert processor failing because of null values #19469 list_issues: has lower integrity than agent requires. The agent cannot read data with integrity below "approved".
   • [ti_cybersixgill] Add Agentless Deployment Support #19454 list_issues: has lower integrity than agent requires. The agent cannot read data with integrity below "approved".
   • ... and 15 more items

   To allow these resources, lower min-integrity in your GitHub frontmatter:

   tools:
     github:
       min-integrity: approved  # merged | approved | unapproved | none

   ---

   What is this? | From workflow: Issue Triage

   Give us feedback! React with 🚀 if perfect, 👍 if helpful, 👎 if not.
6. mohitjha-elastic

   closed this as completedin #19598on Jun 19, 2026