Activity

1. mohitjha-elastic

   self-assigned this

   on Jun 10, 2026
2. mohitjha-elastic

   added

   enhancementNew feature or requestNew feature or request

   Integration:ti_eclecticiqEclecticIQ (Partner supported)EclecticIQ (Partner supported)

   Team:Security-Service IntegrationsSecurity Service Integrations team [elastic/security-service-integrations]Security Service Integrations team [elastic/security-service-integrations]

   on Jun 10, 2026
3. mohitjha-elastic

   added a parent issue on Jun 10, 2026

   • [Epic] Security Integrations | Agentless Support #17973
4. mohitjha-elastic

   added

   Team:SDE-CrestCrest developers on the Security Integrations team [elastic/sit-crest-contractors]Crest developers on the Security Integrations team [elastic/sit-crest-contractors]

   on Jun 10, 2026
5. infra-vault-gh-plugin-prod commented on Jun 10, 2026

   

   infra-vault-gh-plugin-prodBot

   on Jun 10, 2026

   More actions

   Pinging @elastic/security-service-integrations (Team:Security-Service Integrations)
6. github-actions commented on Jun 10, 2026

   

   github-actionsBot

   on Jun 10, 2026 – with GitHub Actions

   Contributor

   More actions

   tl;dr: ti_eclecticiq does not currently declare agentless support, and the primary blocker is that its manifest is still format_version: 3.0.3, where policy_templates[].deployment_modes is not allowed; the right path is to upgrade manifest format and add the standard deployment_modes.agentless block used by other TI packages.

   Recommendation

   Proceed with an agentless-enablement PR for ti_eclecticiq (not a duplicate from what I could verify), with two core changes:

   1. Upgrade packages/ti_eclecticiq/manifest.yml to a format version that supports deployment_modes (>= 3.1.4, ideally aligned with current TI packages on 3.3.x).
   2. Add policy_templates[].deployment_modes with agentless.enabled: true and standard ownership metadata (organization/division/team) matching existing Team:Security-Service Integrations TI packages.

   Findings

   Evidence from repository files

   • packages/ti_eclecticiq/manifest.yml:1 shows format_version: 3.0.3.
   • packages/ti_eclecticiq/manifest.yml:20-25 has policy_templates + CEL input, but no deployment_modes block.
   • docs/extend/manifest-spec.md:661-664 explicitly removes /properties/policy_templates/items/properties/deployment_modes for versions before 3.1.4.
   • Agentless pattern exists in similar TI packages:
     • packages/ti_anomali/manifest.yml:43-53 (deployment_modes.default + deployment_modes.agentless + CEL input)
     • packages/ti_abusech/manifest.yml:46-56 (agentless metadata + CEL input)
     • packages/ti_threatq/manifest.yml:35-45 (agentless metadata + HTTPJSON input)
   • Historical precedent for this exact team/package family:
     • packages/ti_anomali/changelog.yml:65-67 links “Added Agentless deployment mode” to PR #14547.

   Additional context: I could not retrieve issue body/comments for #19476 via MCP due integrity filtering in this run, so conclusions are based on title + codebase evidence.

   Verification

   Commands and output

   $ cd /home/runner/work/integrations/integrations
   $ grep -nE "deployment_modes|agentless" packages/ti_eclecticiq/manifest.yml || true
   # (no output)
   
   $ for f in packages/ti_*/manifest.yml; do if grep -q "agentless:" "$f"; then echo "$f"; fi; done | head -20
   packages/ti_abusech/manifest.yml
   packages/ti_anomali/manifest.yml
   packages/ti_crowdstrike/manifest.yml
   packages/ti_cyware_intel_exchange/manifest.yml
   packages/ti_flashpoint/manifest.yml
   packages/ti_google_threat_intelligence/manifest.yml
   packages/ti_greynoise/manifest.yml
   packages/ti_rapid7_threat_command/manifest.yml
   packages/ti_recordedfuture/manifest.yml
   packages/ti_socradar_taxii/manifest.yml
   packages/ti_threatq/manifest.yml

   Detailed Action Plan

   Implementation steps

   1. Update packages/ti_eclecticiq/manifest.yml:
      • Change format_version from 3.0.3 to a currently accepted version that supports deployment modes (match current TI package conventions).
   2. In policy_templates[0] (packages/ti_eclecticiq/manifest.yml:20+), add:
      • deployment_modes.default.enabled: true
      • deployment_modes.agentless.enabled: true
      • deployment_modes.agentless.release (typically beta in similar TI packages)
      • deployment_modes.agentless.organization/division/team (for this area usually security/engineering/security-service-integrations).
   3. Keep existing stream/input type unchanged unless product requirements say otherwise:
      • packages/ti_eclecticiq/data_stream/threat/manifest.yml:4 currently uses input: cel.
   4. Review any agent-local assumptions in stream config and docs:
      • packages/ti_eclecticiq/data_stream/threat/agent/stream/input.yml.hbs
      • packages/ti_eclecticiq/docs/README.md (currently describes Elastic Agent flow; add agentless deployment guidance/limitations if needed).
   5. Add changelog entry in packages/ti_eclecticiq/changelog.yml referencing the agentless support PR.
   6. Run standard package validation used by this repo for manifest/spec compatibility and docs generation.

   Related Items

   Issues/PRs/files

   Type	Link	Relevance
   Issue	#19476	Request being triaged ([ti_eclecticiq] Add Agentless Deployment Support)
   PR	#14547	Prior TI package (ti_anomali) adding agentless support
   PR	#16535	TI transform unattended-mode change (related TI package lineage)
   PR	#18404	TI transform retry behavior update (related TI package lineage)
   PR	#19106	Recent docs precedent noting unsupported agentless streams in another integration
   File	packages/ti_eclecticiq/manifest.yml	Missing deployment_modes; uses old manifest format
   File	docs/extend/manifest-spec.md:661-664	Spec evidence that deployment_modes is removed before 3.1.4
   File	packages/ti_anomali/manifest.yml	Concrete agentless + CEL template to mirror
   File	packages/ti_abusech/manifest.yml	Another TI/CEL agentless reference with metadata

   Note

   🔒 Integrity filter blocked 79 items

   The following items were blocked because they don't meet the GitHub integrity level.

   • #19476 issue_read: has lower integrity than agent requires. The agent cannot read data with integrity below "approved".
   • #19476 search_issues: has lower integrity than agent requires. The agent cannot read data with integrity below "approved".
   • #17973 search_issues: has lower integrity than agent requires. The agent cannot read data with integrity below "approved".
   • #17560 search_pull_requests: has lower integrity than agent requires. The agent cannot read data with integrity below "approved".
   • #11203 search_pull_requests: has lower integrity than agent requires. The agent cannot read data with integrity below "approved".
   • [ti_eclecticiq] Add Agentless Deployment Support #19476 issue_read: has lower integrity than agent requires. The agent cannot read data with integrity below "approved".
   • #19280 search_pull_requests: has lower integrity than agent requires. The agent cannot read data with integrity below "approved".
   • #18881 search_pull_requests: has lower integrity than agent requires. The agent cannot read data with integrity below "approved".
   • #16714 search_pull_requests: has lower integrity than agent requires. The agent cannot read data with integrity below "approved".
   • #14774 search_pull_requests: has lower integrity than agent requires. The agent cannot read data with integrity below "approved".
   • #12767 search_pull_requests: has lower integrity than agent requires. The agent cannot read data with integrity below "approved".
   • #12968 search_pull_requests: has lower integrity than agent requires. The agent cannot read data with integrity below "approved".
   • #10811 search_pull_requests: has lower integrity than agent requires. The agent cannot read data with integrity below "approved".
   • #18345 search_pull_requests: has lower integrity than agent requires. The agent cannot read data with integrity below "approved".
   • #19319 search_pull_requests: has lower integrity than agent requires. The agent cannot read data with integrity below "approved".
   • #17068 search_pull_requests: has lower integrity than agent requires. The agent cannot read data with integrity below "approved".
   • ... and 63 more items

   To allow these resources, lower min-integrity in your GitHub frontmatter:

   tools:
     github:
       min-integrity: approved  # merged | approved | unapproved | none

   ---

   What is this? | From workflow: Issue Triage

   Give us feedback! React with 🚀 if perfect, 👍 if helpful, 👎 if not.
7. mohitjha-elastic

   closed this as completedin #19716on Jun 24, 2026