[Cato Networks] Sync feature branch with main branch by sharad-elastic · Pull Request #19182 · elastic/integrations

sharad-elastic · 2026-05-25T07:51:27Z

Proposed commit message

Sync feature/cato_networks-0.1.0 branch with latest main branch changes.

…lastic#17670) Change the assets document fingerprint from a full-body hash to a hash of the asset id and all timestamp fields (firstSeen, lastSeen, lastHit, lastSnapshot, lastUpdate, runStatusTime). This preserves update history; a new document is created whenever a timestamp changes without the duplicate-on-every-poll problem caused by the full-body hash. Change the risk.total_risk field type from keyword to double. The field carries a floating-point risk score and double is the correct type. This type change also causes Fleet to trigger an automatic data stream rollover on upgrade: the putMapping call fails with an illegal_argument_exception when it tries to change the field type in the existing backing index, and Fleet responds by rolling over. The rollover starts the life-cycle clock on the old backing index so duplicate documents from the _id scheme change age out without manual intervention. The Kibana version constraint is tightened to ^8.16.1 || ^9.1.4 so that 9.x users see the breaking-change call-out. Where possible, upgrading to 1.1.0 first and allowing at least one asset collection interval before upgrading to 2.0.0 avoids the overlap period entirely.

* Update integration with mock metrics counter * Fix system tests * Update readme * Apply review suggestions * Limit max eps that can be generated by the integration to 200 * Fix review comments

* chore: [updatecli] [weekly] Update latest snapshot to 8.19.14-SNAPSHOT Made with ❤️️ by updatecli --------- Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>

…vents (elastic#18411) crowdstrike: handle nested File object in FDR DataEgressEnriched events DataEgressEnriched events send crowdstrike.File as a nested JSON object instead of a keyword, causing document rejections. Extract sub-fields to ECS file.* and crowdstrike.FileType.Type.*, then remove the Map before indexing. Events where File is already a string are unaffected.

* Remove host.ip and host.mac * update pr number

* Add etw backend to fim * Update description

Add a new integration to collect cyber alerts from the Dataminr Pulse V4 API. The integration uses the CEL input with OAuth client credentials authentication to poll for alerts on a configurable interval. Dataminr alert fields are mapped to ECS and custom fields through an ingest pipeline. Two dashboards are included. Test samples are synthetic data created for testing purposes.

… Managed Device data streams (elastic#18408) The initial release includes Audit and Managed Device data stream and associated dashboard. Microsoft Intune fields are mapped to their corresponding ECS fields where possible. Test samples were derived from live data samples, which were subsequently sanitized.

…ic#18440) Made with ❤️️ by updatecli Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>

…stic#18386) The old documentation stated that "The AWS region is not a requirement when configuring the R2 Bucket." Since Elastic Agent 8.19.12 now requires the region field for non-AWS S3-compatible buckets, this guidance was actively misleading. Replace it with an explicit setup step telling users to set Region to "auto". Fixes elastic#18307

…ert fields (elastic#18158) The flattened type was chosen because a complete list of subfield names is not known. Also restructures the alert pipeline to deserialize JSON straight into `crowdstrike.alert.*` rather than putting it elsewhere and renaming individual fields to their final destinations. Since there are a number of known fields that were intentionally not mapped into the vendor namespace, those are explicitly removed. This may lead to additional dynamically mapped fields if there are more unknown fields in the API's alert payloads.

The AWS Config CEL program accesses state.secret_key and state.access_key without guards. When a user configures the integration with Role ARN or no credentials (both valid for other AWS data streams), the program crashes with the unhelpful error "no such key: secret_key". Add a credential check at the top of the CEL program that detects missing or empty access_key_id / secret_access_key and returns a clear error explaining that static credentials are required and Role ARN is not supported for this data stream. The check uses optional field access (state.?secret_key.orValue("")) to handle both absent and empty-string cases safely. Update the data stream docs and manifest description to state the Role ARN limitation upfront. Add a script test that verifies the error message is emitted when credentials are missing. Fixes elastic#18332

…1.38.0 (elastic#18412) * build(deps): bump github.com/elastic/package-registry Bumps [github.com/elastic/package-registry](https://github.com/elastic/package-registry) from 1.37.0 to 1.38.0. - [Release notes](https://github.com/elastic/package-registry/releases) - [Changelog](https://github.com/elastic/package-registry/blob/main/CHANGELOG.md) - [Commits](elastic/package-registry@v1.37.0...v1.38.0) --- updated-dependencies: - dependency-name: github.com/elastic/package-registry dependency-version: 1.38.0 dependency-type: direct:production update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] <support@github.com> * Update go-version to match go.mod requirement --------- Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Co-authored-by: Mario Rodriguez Molins <mario.rodriguez@elastic.co>

…tic#18361) * [aws_lambda] enable agentless deployment for aws lambda metrics * add pr link * update readme * update readme

* update agent-version-conditions doc * fix linting

) * [aws_elb] enable agentless deployment for aws elb metrics * add pr link * add readme note * fix review comments * increment version * update readme * bump version

) * [aws_sqs] enable agentless deployment for aws sqs metrics * update readme * update pr link

* profiling_otel: add new integration Signed-off-by: Florian Lehner <florian.lehner@elastic.co> * fix README.md Signed-off-by: Florian Lehner <florian.lehner@elastic.co> * add policy test Signed-off-by: Florian Lehner <florian.lehner@elastic.co> * skip test Signed-off-by: Florian Lehner <florian.lehner@elastic.co> --------- Signed-off-by: Florian Lehner <florian.lehner@elastic.co>

…tages (elastic#18510) packages/o365: prune stale listing URLs from cursor to recover from long outages A listing URL queued in cursor.todo_links before a prolonged outage can age past the Management API's 7-day startTime window while parked there, producing a permanent AF20055 retry loop: the listing-error branch cannot evict it because its map-shaped error return is treated by the CEL runtime as a freeze signal that discards cursor mutations. Add a pre-flight filter that drops listing URLs whose embedded startTime is older than now - maximum_age, tolerating both startTime and starttime spellings (NextPageUri responses have been observed with the lowercase form). Includes a system test that queues a NextPageUri with a 2019 startTime against a 1h maximum_age and asserts it is not followed.

…tic#18362) * [aws] enable agentless deployment for aws health metrics * add pr link * update readme

…elastic#18395) ## Summary - Fixed broken VPC flow log detection condition in the firehose ingest pipeline that had two bugs: operator precedence (`&&` vs `||`) and incorrect string matching (`"eni-` with leading quote never matched inside JSON-wrapped messages) - Replaced the fragile condition with robust detection covering all VPC flow log variants (v2-v10): - `tgw-` + `transitgateway` — transit gateway flow logs (default format includes `resource-type: TransitGateway`) - `eni-` — standard VPC flow logs, requires a secondary marker (`accept`, `reject`, `nodata`, `skipdata`) - `nat-` — v9 regional NAT gateway flow logs (where `interface-id` is `-`), requires a secondary marker - Expanded VPC flow log test suite from 1 case to 16, covering all versions (v2-v10) and all field formats supported by the downstream vpcflow pipeline (14, 17, 18, 21, 29, 30, 36, 39, 40 tokens), using examples from the [official AWS VPC Flow Logs documentation](https://docs.aws.amazon.com/vpc/latest/userguide/flow-logs-records-examples.html) - Added a regression test to the firewall test suite: a firewall log with `"action":"reject"` that must route to `aws.firewall_logs`, not `aws.vpcflow` — this is the exact scenario the original operator precedence bug caused - Added a ["How log routing works"](https://github.com/elastic/integrations/blob/fix/firehose-vpcflow-operator-precedence/packages/awsfirehose/docs/README.md#how-log-routing-works) section to the docs explaining the detection method and format requirements for each log type - Bumped package version to 1.9.1 ### Known limitation VPC flow logs using custom formats that exclude both the `action` and `log-status` fields (e.g., the [6-field zonal NAT gateway format](https://docs.aws.amazon.com/vpc/latest/userguide/flow-logs-records-examples.html#flow-log-example-nat)) cannot be detected through content matching alone. The default format always includes `action` and `log-status`, so this only affects deliberately minimal custom configurations. Users with such formats should use the `es_datastream_name` delivery stream parameter for routing instead.

…astic#18363) * [aws_billing] agentless deployment for aws billing metrics * add pr link * update readme

* generated rules * tweaks to node health rules * deployment-unavailable-replicas: 1m window, clearer var names Overlapping 5m windows masked real failures; let alert_delay handle persistence. Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com> * daemonset-mis-scheduled: 1m schedule/window, MIN for ready, clearer var names Overlapping 10m windows masked failures; MIN(ready) catches dips, MAX(misscheduled) stays. Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com> * statefulset-replicas-not-ready: 1m schedule/window, MIN for ready, clearer var names Same fix as other workload rules; let alert_delay handle persistence. Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com> * pod-crashloopbackoff: use TS + RATE to detect active crash loops only Replaces cumulative restart count with rate-of-change; stops firing on stale history. Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com> * pod-crashloopbackoff: use TS, simplify to restarts > 0, keep 15m window RATE doesn't apply — field is a gauge, not a counter. Restarts > 0 with alert_delay handles persistence; kubelet prune resets clear stale alerts. Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com> * oomkilled-containers: use TS, drop redundant restarts filter, keep restarts for context OOMKilled filter is sufficient; restarts kept in output for severity context. Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com> * pods-failed-phase: VALUES + MV_CONTAINS to catch transient Failed phases LAST missed Failed→Unknown transitions; VALUES collects all phases seen in the 5m window. Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com> * pods-failed-phase: fix MV_CONTAINS type mismatch with TO_LONG(4) Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com> * pods-pending-phase: use TS, LAST for current phase, 1m window Unlike Failed, Pending needs current state — a pod that scheduled is fine. alert_delay: 5 handles scheduling grace period. Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com> * job-failures: use TS, 1m schedule, 5m window, clearer var name 30m window was excessive; 5m is enough to catch the metric. Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com> * use TS instead of FROM for all reviewed metrics rules More efficient for time series queries on metrics indices. Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com> * node-cpu-saturation: join kubeletstats + clusterreceiver for dynamic threshold Usage from kubeletstatsreceiver, allocatable from k8sclusterreceiver. Replaces hardcoded core threshold with utilization ratio. Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com> * node-cpu/memory-saturation: add fallback guidance for static thresholds Note in ES|QL comments that users can replace utilization check with a static threshold if allocatable metrics are not available. Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com> * filesystem/container-memory/pv saturation rules: FROM -> TS Queries already well-designed with ratio-based thresholds; just needed TS. Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com> * add node-disk-pressure, container-cpu-throttling, hpa-at-max-replicas rules Three high-value gap fills: kubelet disk pressure condition, CPU limit utilization for latency-invisible throttling, and HPA ceiling detection. Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com> * standardise tags to ["Kubernetes"] across all alert rules Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com> * fix stale investigation guides to match updated queries Remove setup/prerequisite info from guides (belongs in query comments). Update crashloopbackoff guide for restarts > 0 threshold. Remove reference to nonexistent inode alert. Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com> * add changelog * fix rule naming conventions * workload rules: use LAST for all fields to avoid scale-up/down false positives MAX(desired) held stale peaks on scale-down, MIN(ready) caught transient dips on scale-up. LAST gives current state; alert_delay handles persistence. Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com> * add status labels, use MAX for pending phase to detect truly stuck pods Human-readable EVAL status for condition/phase rules. Pending rule uses MAX(phase) == 1 so pods that progressed beyond Pending are excluded — only truly stuck pods alert. Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com> * add rules to readme * remove docs build file * fix attribute casing --------- Co-authored-by: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

* Add EUIDs * fix indentation * fix indentation * update dashboards * add dashboard changes for host traffic anomalies package * restore host.name/user.name in influencers * update ML anomalies datastream index pattern * rename files for EA changes * rollback EUID changes, add required fields for entity resolution, change documentation * roll back minumum stack version changes * update hta * remove `agent.name` from PAD windows transform * fix formatting * update documentation to match kibana PR * fix ml job/transform fields * fix PAD ML job formatting * Update changelog links, fix HTA version * fix version in readme * fix version in readme * Update packages/lmd/docs/README.md Co-authored-by: Kirti Sodhi <109447885+sodhikirti07@users.noreply.github.com> * add `host.name` for Okta ML transforms/influencers. fix datafeed for `pad_okta_rare_host_name_by_user_ea` * documentation consistency fix * add more verbose descriptions to changelog * fix index pattern in dashboard docs * change Okta ML job parition fields to `user.name`, add `user.name` as top level group by in Okta transform * add `user.name` to okta pivot transfrorm mappings * change `on_failure` processor to set as `event.kind` is not an array * Fix broken anchor links in detection docs Convert bold list items to headings so #enable-detection-rules and #enabling-detection-rules anchors resolve in docs-builder. Affects: ded, dga, lmd, problemchild Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com> * PAD readme fixes * PAD Windows dashboard/rare region job fixes * add missing by/over/partition field names to influencers * add additional influencers fields from `field_name` * Update packages/ded/docs/README.md Co-authored-by: Nastasha Solomon <79124755+nastasha-solomon@users.noreply.github.com> * update readmes for concurrent rule release * Add filter field data for transforms and jobs to readmes, improve documentation on beats * bump manifest version/add to changelog for Beaconing * bump beaconing transform version to 1.5.4 to match manifest * pin minimum Kibana version to 9.4.0, update documentation * Update packages/lmd/docs/README.md Co-authored-by: Susan <23287722+susan-shu-c@users.noreply.github.com> * Update packages/ded/docs/README.md Co-authored-by: Susan <23287722+susan-shu-c@users.noreply.github.com> * Update packages/dga/docs/README.md Co-authored-by: Susan <23287722+susan-shu-c@users.noreply.github.com> * Update packages/hta/docs/README.md Co-authored-by: Susan <23287722+susan-shu-c@users.noreply.github.com> * Update packages/problemchild/docs/README.md Co-authored-by: Susan <23287722+susan-shu-c@users.noreply.github.com> * Update packages/pad/docs/README.md Co-authored-by: Susan <23287722+susan-shu-c@users.noreply.github.com> --------- Co-authored-by: Kirti Sodhi <109447885+sodhikirti07@users.noreply.github.com> Co-authored-by: Fabrizio Ferri Benedetti <fabri.ferribenedetti@elastic.co> Co-authored-by: Claude Opus 4.6 (1M context) <noreply@anthropic.com> Co-authored-by: Nastasha Solomon <79124755+nastasha-solomon@users.noreply.github.com> Co-authored-by: Susan <23287722+susan-shu-c@users.noreply.github.com>

* [aws_transitgateway] enable agentless deployment for aws transitgateway metrics * add pr link * update readme

github: add agentless deployment

…stic#18526) Bumps [updatecli/updatecli-action](https://github.com/updatecli/updatecli-action) from 3.1.1 to 3.1.3. - [Release notes](https://github.com/updatecli/updatecli-action/releases) - [Commits](updatecli/updatecli-action@7aab164...2c3221b) --- updated-dependencies: - dependency-name: updatecli/updatecli-action dependency-version: 3.1.3 dependency-type: direct:production update-type: version-update:semver-patch ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>

) * [aws_sns] enable agentless deployment for aws sns metrics * add pr link * update readme * bump version * bump version

…ic#18532) Made with ❤️️ by updatecli Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>

…stic#19110) The ThreatConnect API returns indicator IDs as JSON numbers. When these exceed the IEEE 754 safe integer limit (2^53), the CEL program's decode_json() rounds them through float64, causing distinct IDs like 9007199254918487, 9007199254918488, and 9007199254918489 to all collapse to 9007199254918488. Replace decode_json() with decode_json_string_numbers() so that all JSON numbers are preserved as their literal string form. The ingest pipeline already uses convert processors with explicit type coercions for numeric fields, so string-valued numbers are handled correctly downstream. Add a script test that verifies indicator IDs above 2^53 are preserved correctly. The test mock returns two Address indicators whose IDs both round to the same float64 value and asserts that both distinct values appear in threat_connect.indicator.id after ingestion. The minimum stack version is raised to 8.19.0/9.1.0, which is the first version shipping a mito release that includes the decode_json_string_numbers function. Fixes elastic#19109

* Fix section title typo in apm dashboard * Apply suggestions from code review Co-authored-by: Carson Ip <carsonip@users.noreply.github.com> --------- Co-authored-by: Carson Ip <carsonip@users.noreply.github.com>

The beats entity-analytics input already collects all Active Directory groups for membership enrichment; their names and SIDs appear within user and device entities via the user.group fields. Groups with no direct members are invisible to this process because they have no member links to follow. The include_empty_groups option (elastic/beats#49093) makes the input emit standalone documents for these otherwise-invisible groups so they appear in the asset inventory. This change adds the integration-side support: a group ingest pipeline, a routing rule to direct group documents to a dedicated data stream, and ECS and vendor field definitions. The entity pipeline dispatch is updated to recognise group documents (ctx.group.id != null) and the fallback entity pipeline condition now excludes them. Pipeline tags are corrected to distinguish user, device, and group dispatch.

… docs (elastic#19104) Add helper script for backport release commit lookup and improve hotfix workflow docs - Add dev/scripts/get_release_commit.sh to find the git commit where a package version was first released, replacing a manual git log lookup - Add .buildkite/scripts/run_dev_scripts_tests.sh with unit tests for the helper script and wire it into the Buildkite pipeline - Improve docs/extend/developer-workflow-support-old-package.md with structural, clarity, and accuracy fixes to the backport hotfix workflow --------- Co-authored-by: Claude Sonnet 4.6 <noreply@anthropic.com>

Point the Vale lint and report workflows at the migrated docs-actions action paths so integrations follows the new shared location. Co-authored-by: GPT-5.5 <gpt-5.5@openai.com> Co-authored-by: Cursor <cursoragent@cursor.com>

…lastic#19147) packages/claroty_xdome: handle nullable CEL response arrays Branch on non-empty Claroty response arrays before mapping them or advancing pagination state so null responses do not degrade CEL streams. Return no worklist when top-level alert and vulnerability responses are empty or null, and reset parent offsets so stale pagination state does not carry into the next collection interval. Preserve device-page handling for parent-only events and worklist advancement, and add nullable device-response coverage alongside the existing empty-array coverage. Mark synthetic device-page events as retries and drop them with a Filebeat processor. This keeps placeholder events from reaching ingest while still allowing CEL state to advance across empty device pages. --------- Co-authored-by: Cursor <cursoragent@cursor.com>

@shmsr

* Added audit datastream. * Updated changelog entry * Resolve readme comments provided by @shmsr. * Resolved bot comments. * Added openai/audit codeowner entry. * Add explicit CODEOWNERS entries for all openai data streams The CI check requires that if any data stream in a package has an explicit per-stream CODEOWNERS entry, all data streams must have one. Add entries for the remaining 8 data streams with the parent team while keeping audit owned by @elastic/security-service-integrations. * Added geoip processor. --------- Co-authored-by: muskan-crest <muskan.agarwal@crestdata.ai> Co-authored-by: subham sarkar <subham.sarkar@elastic.co>

…mp?.action` within the php-fpm ingest pipeline. (elastic#19033)

…s for other types (elastic#18903) * fix: elastic#18153 — [cisco_ise]: fix missing event.category/type/outcome for CISE_Failed_Attempts 5401-5452 and CISE_Passed_Authentications 5201-5241 - Add event.category, event.type, and event.outcome mappings for CISE_Failed_Attempts codes 5401-5452 and CISE_Passed_Authentications codes 5201-5241 that previously had no ECS categorisation. - Set event.outcome=failure unconditionally on all CISE_Failed_Attempts events, regardless of message code. - Fix ECS violations: event.type=denied is not valid under event.category=authentication (codes 5434, 5449, 5451 → changed to event.type=end); event.type=change is not valid under event.category=network (code 5205 → changed to event.type=info). - Add pipeline test fixtures (sample logs + regenerated expected JSON) for every newly mapped message code. Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com> * minor fixes to mapping for a couple of message codes. * update changelog entry * address review comments --------- Co-authored-by: Claude Sonnet 4.6 <noreply@anthropic.com>

The fields originally chosen for fingerprinting do not create a unique fingerprint. The new fields create a more unique fingerprint. --------- Co-authored-by: Ilya Nikokoshev <ilya.nikokoshev@elastic.co>

* Use standardized OTel Naming convention * update changelog

…c#19013) imperva_cloud_waf: fix CEL type guard for events field access The guard has(v.?events.error) at the outer .as(v, ...) expression is intended to detect error responses, where events is a map {"error": {...}}. When the worklist has multiple entries, the worklist-continuation branch returns state wholesale, carrying the previous iteration's list-valued events into v. CEL then attempts string-key field access (.error) on that list and throws "unsupported index type 'string' in list", cycling the input unit HEALTHY→DEGRADED on every poll and halting ingestion entirely. This is triggered in practice when the Imperva API delivers non-WAF event types (e.g. Client-Side Protection SIEM events) alongside WAF logs through the same endpoint, as the additional log volume increases the likelihood of a multi-file worklist. Add an explicit type check before the field access so that .error is only accessed when v.events is actually a map.

…7775) The initial release includes event data stream and associated dashboard. Cato Networks fields are mapped to their corresponding ECS fields where possible. Test samples were derived from live data samples, which were subsequently sanitized. * resolved review comments * resolved review comments

…7968) This release includes audit data stream and associated dashboard. Cato Networks fields are mapped to their corresponding ECS fields where possible. Test samples were derived from live data samples, which were subsequently sanitized.

…NERS (elastic#19158) Update changelog entry, manifest version and sync CODEOWNERS file with main branch. --------- Co-authored-by: sharadcrest <sharad.kevadiya@crestdata.ai>

cla-checker-service · 2026-05-25T07:51:42Z

❌ Author of the following commits did not sign a Contributor Agreement:
, , , , , , , , , , , , , , , , , , , , , , , , , , , , , 158ae25, e012a9f, 371d08f, , , ,

Please, read and sign the above mentioned agreement if you want to contribute to this project

github-actions · 2026-05-25T07:57:13Z

Vale Linting Results

Summary: 199 warnings, 141 suggestions found

⚠️ Warnings (199)

File	Line	Rule	Message
README.md	18	Elastic.DontUse	Don't use 'Please'.
docs/ci_pipelines.md	11	Elastic.DontUse	Don't use 'just'.
docs/ci_pipelines.md	226	Elastic.DontUse	Don't use 'just'.
docs/extend/add-mapping.md	58	Elastic.DontUse	Don't use 'just'.
docs/extend/agent-version-conditions.md	2	Elastic.MappedPages	mapped_pages should only be added or updated in rare scenarios. Talk with your local technical writer before pushing changes to this key.
docs/extend/dashboard-guidelines.md	97	Elastic.Latinisms	Latin terms and abbreviations are a common source of confusion. Use 'versus' instead of 'vs'.
docs/extend/developer-workflow-import-beat.md	92	Elastic.Latinisms	Latin terms and abbreviations are a common source of confusion. Use 'for example' instead of 'e.g'.
docs/extend/general-guidelines.md	88	Elastic.Latinisms	Latin terms and abbreviations are a common source of confusion. Use 'and so on' instead of 'etc'.
packages/airflow_otel/docs/README.md	44	Elastic.DirectionalLanguage	Don't use directional language. Use 'the following element' instead of 'The example below'.
packages/apache_tomcat_otel/docs/README.md	58	Elastic.Latinisms	Latin terms and abbreviations are a common source of confusion. Use 'for example' instead of 'e.g'.
packages/apache_tomcat_otel/docs/README.md	59	Elastic.Latinisms	Latin terms and abbreviations are a common source of confusion. Use 'for example' instead of 'e.g'.
packages/apache_tomcat_otel/docs/README.md	60	Elastic.Latinisms	Latin terms and abbreviations are a common source of confusion. Use 'for example' instead of 'e.g'.
packages/aws/_dev/build/docs/dynamodb.md	29	Elastic.DontUse	Don't use 'please'.
packages/aws/docs/dynamodb.md	29	Elastic.DontUse	Don't use 'please'.
packages/aws/docs/securityhub.md	1383	Elastic.DirectionalLanguage	Don't use directional language. Use 'earlier on this page' instead of 'noted above'.
packages/aws/docs/securityhub.md	1384	Elastic.QuotesPunctuation	Place punctuation inside closing quotation marks.
packages/aws/docs/securityhub.md	1385	Elastic.Latinisms	Latin terms and abbreviations are a common source of confusion. Use 'for example' instead of 'e.g'.
packages/aws/docs/securityhub.md	1387	Elastic.Latinisms	Latin terms and abbreviations are a common source of confusion. Use 'for example' instead of 'e.g'.
packages/beaconing/docs/README.md	33	Elastic.MenuArrows	Use '→' to separate menu items, not '' or '='. Example: Select Manage index → Add lifecycle policy.
packages/cato_networks/_dev/build/docs/README.md	45	Elastic.MenuArrowsBold	Use '→' to separate menu items, not '' or '='. Example: Select Manage index → Add lifecycle policy.
packages/cato_networks/_dev/build/docs/README.md	47	Elastic.Latinisms	Latin terms and abbreviations are a common source of confusion. Use 'for example' instead of 'e.g'.
packages/cato_networks/_dev/build/docs/README.md	50	Elastic.MenuArrowsBold	Use '→' to separate menu items, not '' or '='. Example: Select Manage index → Add lifecycle policy.
packages/cisco_nexus/docs/README.md	380	Elastic.Latinisms	Latin terms and abbreviations are a common source of confusion. Use 'for example' instead of 'e.g'.
packages/cisco_nexus/docs/README.md	380	Elastic.DontUse	Don't use 'please'.
packages/cisco_nexus/docs/README.md	383	Elastic.Latinisms	Latin terms and abbreviations are a common source of confusion. Use 'for example' instead of 'e.g'.
packages/cisco_nexus/docs/README.md	384	Elastic.Latinisms	Latin terms and abbreviations are a common source of confusion. Use 'for example' instead of 'e.g'.
packages/cisco_nexus/docs/README.md	384	Elastic.Latinisms	Latin terms and abbreviations are a common source of confusion. Use 'for example' instead of 'e.g'.
packages/cisco_nexus/docs/README.md	384	Elastic.Latinisms	Latin terms and abbreviations are a common source of confusion. Use 'for example' instead of 'e.g'.
packages/cisco_nexus/docs/README.md	384	Elastic.Latinisms	Latin terms and abbreviations are a common source of confusion. Use 'for example' instead of 'e.g'.
packages/cisco_nexus/docs/README.md	394	Elastic.Latinisms	Latin terms and abbreviations are a common source of confusion. Use 'for example' instead of 'e.g'.
packages/cisco_nexus/docs/README.md	399	Elastic.Latinisms	Latin terms and abbreviations are a common source of confusion. Use 'for example' instead of 'e.g'.
packages/cloudflare_logpush/_dev/build/docs/README.md	131	Elastic.DontUse	Don't use 'just'.
packages/crowdstrike/docs/README.md	3792	Elastic.Latinisms	Latin terms and abbreviations are a common source of confusion. Use 'for example' instead of 'e.g'.
packages/crowdstrike/docs/README.md	3793	Elastic.Latinisms	Latin terms and abbreviations are a common source of confusion. Use 'and so on' instead of 'etc'.
packages/crowdstrike/docs/README.md	3793	Elastic.DirectionalLanguage	Don't use directional language. Use 'earlier on this page' instead of 'noted above'.
packages/crowdstrike/docs/README.md	3794	Elastic.DirectionalLanguage	Don't use directional language. Use 'earlier on this page' instead of 'noted above'.
packages/crowdstrike/docs/README.md	3795	Elastic.QuotesPunctuation	Place punctuation inside closing quotation marks.
packages/crowdstrike/docs/README.md	3796	Elastic.Latinisms	Latin terms and abbreviations are a common source of confusion. Use 'for example' instead of 'e.g'.
packages/crowdstrike/docs/README.md	3797	Elastic.Latinisms	Latin terms and abbreviations are a common source of confusion. Use 'for example' instead of 'e.g'.
packages/cursor/docs/README.md	200	Elastic.Latinisms	Latin terms and abbreviations are a common source of confusion. Use 'for example' instead of 'e.g'.
packages/cursor/docs/README.md	200	Elastic.DontUse	Don't use 'please'.
packages/cursor/docs/README.md	202	Elastic.Latinisms	Latin terms and abbreviations are a common source of confusion. Use 'for example' instead of 'e.g'.
packages/cursor/docs/README.md	221	Elastic.QuotesPunctuation	Place punctuation inside closing quotation marks.
packages/cursor/docs/README.md	221	Elastic.DontUse	Don't use 'and/or'.
packages/cursor/docs/README.md	223	Elastic.QuotesPunctuation	Place punctuation inside closing quotation marks.
packages/cursor/docs/README.md	224	Elastic.DontUse	Don't use 'just'.
packages/cursor/docs/README.md	227	Elastic.QuotesPunctuation	Place punctuation inside closing quotation marks.
packages/cursor/docs/README.md	229	Elastic.QuotesPunctuation	Place punctuation inside closing quotation marks.
packages/cursor/docs/README.md	230	Elastic.QuotesPunctuation	Place punctuation inside closing quotation marks.
packages/darktrace/_dev/build/docs/README.md	9	Elastic.BritishSpellings	Use American English spelling 'analyze' instead of British English 'analyse'.
packages/darktrace/docs/README.md	9	Elastic.BritishSpellings	Use American English spelling 'analyze' instead of British English 'analyse'.
packages/dataminr_pulse/README.md	106	Elastic.DirectionalLanguage	Don't use directional language. Use 'the following element' instead of 'The table below'.
packages/dataminr_pulse/README.md	114	Elastic.Latinisms	Latin terms and abbreviations are a common source of confusion. Use 'for example' instead of 'e.g'.
packages/dataminr_pulse/README.md	198	Elastic.Latinisms	Latin terms and abbreviations are a common source of confusion. Use 'versus' instead of 'vs'.
packages/dataminr_pulse/README.md	212	Elastic.Latinisms	Latin terms and abbreviations are a common source of confusion. Use 'for example' instead of 'e.g'.
packages/dataminr_pulse/docs/README.md	106	Elastic.DirectionalLanguage	Don't use directional language. Use 'the following element' instead of 'The table below'.
packages/dataminr_pulse/docs/README.md	114	Elastic.Latinisms	Latin terms and abbreviations are a common source of confusion. Use 'for example' instead of 'e.g'.
packages/dataminr_pulse/docs/README.md	198	Elastic.Latinisms	Latin terms and abbreviations are a common source of confusion. Use 'versus' instead of 'vs'.
packages/dataminr_pulse/docs/README.md	212	Elastic.Latinisms	Latin terms and abbreviations are a common source of confusion. Use 'for example' instead of 'e.g'.
packages/ded/docs/README.md	16	Elastic.MenuArrows	Use '→' to separate menu items, not '' or '='. Example: Select Manage index → Add lifecycle policy.
packages/ded/docs/README.md	40	Elastic.MenuArrows	Use '→' to separate menu items, not '' or '='. Example: Select Manage index → Add lifecycle policy.
packages/ded/docs/README.md	52	Elastic.DirectionalLanguage	Don't use directional language. Use 'the following steps' instead of 'the below steps'.
packages/ded/docs/README.md	55	Elastic.MenuArrows	Use '→' to separate menu items, not '' or '='. Example: Select Manage index → Add lifecycle policy.
packages/ded/docs/README.md	58	Elastic.DirectionalLanguage	Don't use directional language. Use 'the label of the element' instead of 'on the right side'.
packages/ded/docs/README.md	83	Elastic.DirectionalLanguage	Don't use directional language. Use 'the following element' instead of 'the steps below'.
packages/ded/docs/README.md	102	Elastic.DirectionalLanguage	Don't use directional language. Use 'in the following section' instead of 'outlined below'.
packages/ded/docs/README.md	105	Elastic.DirectionalLanguage	Don't use directional language. Use 'in the following section' instead of 'listed below'.
packages/dga/docs/README.md	3	Elastic.DontUse	Don't use 'Please'.
packages/dga/docs/README.md	17	Elastic.MenuArrowsBold	Use '→' to separate menu items, not '' or '='. Example: Select Manage index → Add lifecycle policy.
packages/dga/docs/README.md	19	Elastic.MenuArrows	Use '→' to separate menu items, not '' or '='. Example: Select Manage index → Add lifecycle policy.
packages/dga/docs/README.md	95	Elastic.DirectionalLanguage	Don't use directional language. Use 'the following element' instead of 'the steps below'.
packages/dga/docs/README.md	114	Elastic.DirectionalLanguage	Don't use directional language. Use 'in the following section' instead of 'outlined below'.
packages/elasticsearch/docs/README.md	324	Elastic.Latinisms	Latin terms and abbreviations are a common source of confusion. Use 'for example' instead of 'e.g'.
packages/elasticsearch/docs/README.md	338	Elastic.Latinisms	Latin terms and abbreviations are a common source of confusion. Use 'for example' instead of 'e.g'.
packages/elasticsearch/docs/README.md	338	Elastic.DontUse	Don't use 'please'.
packages/elasticsearch/docs/README.md	345	Elastic.Latinisms	Latin terms and abbreviations are a common source of confusion. Use 'for example' instead of 'e.g'.
packages/entityanalytics_ad/docs/README.md	383	Elastic.Latinisms	Latin terms and abbreviations are a common source of confusion. Use 'and so on' instead of 'etc'.
packages/entityanalytics_ad/docs/README.md	383	Elastic.DirectionalLanguage	Don't use directional language. Use 'earlier on this page' instead of 'noted above'.
packages/entityanalytics_ad/docs/README.md	384	Elastic.DirectionalLanguage	Don't use directional language. Use 'earlier on this page' instead of 'noted above'.
packages/entityanalytics_ad/docs/README.md	385	Elastic.QuotesPunctuation	Place punctuation inside closing quotation marks.
packages/entityanalytics_ad/docs/README.md	409	Elastic.Latinisms	Latin terms and abbreviations are a common source of confusion. Use 'for example' instead of 'e.g'.
packages/entityanalytics_ad/docs/README.md	410	Elastic.Latinisms	Latin terms and abbreviations are a common source of confusion. Use 'for example' instead of 'e.g'.
packages/entityanalytics_okta/_dev/build/docs/README.md	59	Elastic.DirectionalLanguage	Don't use directional language. Use 'the label of the element' instead of 'left-hand side'.
packages/entityanalytics_okta/docs/README.md	59	Elastic.DirectionalLanguage	Don't use directional language. Use 'the label of the element' instead of 'left-hand side'.
packages/envoyproxy_otel/docs/README.md	39	Elastic.Latinisms	Latin terms and abbreviations are a common source of confusion. Use 'for example' instead of 'e.g'.
packages/envoyproxy_otel/docs/README.md	71	Elastic.Latinisms	Latin terms and abbreviations are a common source of confusion. Use 'for example' instead of 'e.g'.
packages/eset_protect/docs/README.md	215	Elastic.Latinisms	Latin terms and abbreviations are a common source of confusion. Use 'that is' instead of 'i.e'.
packages/eset_protect/docs/README.md	216	Elastic.Latinisms	Latin terms and abbreviations are a common source of confusion. Use 'that is' instead of 'i.e'.
packages/eset_protect/docs/README.md	218	Elastic.Latinisms	Latin terms and abbreviations are a common source of confusion. Use 'that is' instead of 'i.e'.
packages/eset_protect/docs/README.md	219	Elastic.Latinisms	Latin terms and abbreviations are a common source of confusion. Use 'that is' instead of 'i.e'.
packages/fim/docs/README.md	151	Elastic.DontUse	Don't use 'just'.
packages/forescout/docs/README.md	108	Elastic.Latinisms	Latin terms and abbreviations are a common source of confusion. Use 'and so on' instead of 'etc'.
packages/forescout/docs/README.md	108	Elastic.DirectionalLanguage	Don't use directional language. Use 'earlier on this page' instead of 'noted above'.
packages/forescout/docs/README.md	109	Elastic.DirectionalLanguage	Don't use directional language. Use 'earlier on this page' instead of 'noted above'.
packages/forescout/docs/README.md	110	Elastic.QuotesPunctuation	Place punctuation inside closing quotation marks.
packages/forescout/docs/README.md	112	Elastic.Latinisms	Latin terms and abbreviations are a common source of confusion. Use 'for example' instead of 'e.g'.
packages/forescout/docs/README.md	114	Elastic.Latinisms	Latin terms and abbreviations are a common source of confusion. Use 'for example' instead of 'e.g'.
packages/forescout/docs/README.md	130	Elastic.Latinisms	Latin terms and abbreviations are a common source of confusion. Use 'for example' instead of 'e.g'.
packages/forescout/docs/README.md	131	Elastic.Latinisms	Latin terms and abbreviations are a common source of confusion. Use 'for example' instead of 'e.g'.
packages/fortinet_fortigate/docs/README.md	855	Elastic.QuotesPunctuation	Place punctuation inside closing quotation marks.
packages/fortinet_fortigate/docs/README.md	855	Elastic.DontUse	Don't use 'and/or'.
packages/fortinet_fortigate/docs/README.md	859	Elastic.DontUse	Don't use 'just'.
packages/fortinet_fortigate/docs/README.md	861	Elastic.QuotesPunctuation	Place punctuation inside closing quotation marks.
packages/fortinet_fortigate/docs/README.md	862	Elastic.QuotesPunctuation	Place punctuation inside closing quotation marks.
packages/gcp/docs/audit.md	76	Elastic.Latinisms	Latin terms and abbreviations are a common source of confusion. Use 'for example' instead of 'e.g'.
packages/gcp/docs/audit.md	78	Elastic.Latinisms	Latin terms and abbreviations are a common source of confusion. Use 'for example' instead of 'e.g'.
packages/gcp/docs/audit.md	79	Elastic.Latinisms	Latin terms and abbreviations are a common source of confusion. Use 'that is' instead of 'i.e'.
packages/gcp/docs/audit.md	79	Elastic.Latinisms	Latin terms and abbreviations are a common source of confusion. Use 'for example' instead of 'e.g'.
packages/github/docs/README.md	237	Elastic.DirectionalLanguage	Don't use directional language. Use 'earlier on this page' instead of 'noted above'.
packages/github/docs/README.md	238	Elastic.QuotesPunctuation	Place punctuation inside closing quotation marks.
packages/github/docs/README.md	239	Elastic.Latinisms	Latin terms and abbreviations are a common source of confusion. Use 'for example' instead of 'e.g'.
packages/github/docs/README.md	241	Elastic.Latinisms	Latin terms and abbreviations are a common source of confusion. Use 'for example' instead of 'e.g'.
packages/github/docs/README.md	416	Elastic.DirectionalLanguage	Don't use directional language. Use 'earlier on this page' instead of 'noted above'.
packages/github/docs/README.md	417	Elastic.QuotesPunctuation	Place punctuation inside closing quotation marks.
packages/github/docs/README.md	418	Elastic.Latinisms	Latin terms and abbreviations are a common source of confusion. Use 'for example' instead of 'e.g'.
packages/github/docs/README.md	420	Elastic.Latinisms	Latin terms and abbreviations are a common source of confusion. Use 'for example' instead of 'e.g'.
packages/github/docs/README.md	572	Elastic.DirectionalLanguage	Don't use directional language. Use 'earlier on this page' instead of 'noted above'.
packages/github/docs/README.md	573	Elastic.QuotesPunctuation	Place punctuation inside closing quotation marks.
packages/github/docs/README.md	574	Elastic.Latinisms	Latin terms and abbreviations are a common source of confusion. Use 'for example' instead of 'e.g'.
packages/github/docs/README.md	576	Elastic.Latinisms	Latin terms and abbreviations are a common source of confusion. Use 'for example' instead of 'e.g'.
packages/github/docs/README.md	805	Elastic.DirectionalLanguage	Don't use directional language. Use 'earlier on this page' instead of 'noted above'.
packages/github/docs/README.md	806	Elastic.QuotesPunctuation	Place punctuation inside closing quotation marks.
packages/github/docs/README.md	807	Elastic.Latinisms	Latin terms and abbreviations are a common source of confusion. Use 'for example' instead of 'e.g'.
packages/github/docs/README.md	809	Elastic.Latinisms	Latin terms and abbreviations are a common source of confusion. Use 'for example' instead of 'e.g'.
packages/greenhouse/_dev/build/docs/README.md	29	Elastic.MenuArrows	Use '→' to separate menu items, not '' or '='. Example: Select Manage index → Add lifecycle policy.
packages/greenhouse/_dev/build/docs/README.md	40	Elastic.MenuArrowsBold	Use '→' to separate menu items, not '' or '='. Example: Select Manage index → Add lifecycle policy.
packages/greenhouse/_dev/build/docs/README.md	40	Elastic.MenuArrows	Use '→' to separate menu items, not '' or '='. Example: Select Manage index → Add lifecycle policy.
packages/greenhouse/docs/README.md	29	Elastic.MenuArrows	Use '→' to separate menu items, not '' or '='. Example: Select Manage index → Add lifecycle policy.
packages/greenhouse/docs/README.md	40	Elastic.MenuArrowsBold	Use '→' to separate menu items, not '' or '='. Example: Select Manage index → Add lifecycle policy.
packages/greenhouse/docs/README.md	40	Elastic.MenuArrows	Use '→' to separate menu items, not '' or '='. Example: Select Manage index → Add lifecycle policy.
packages/hashicorp_vault/docs/README.md	602	Elastic.Latinisms	Latin terms and abbreviations are a common source of confusion. Use 'for example' instead of 'e.g'.
packages/hashicorp_vault/docs/README.md	602	Elastic.QuotesPunctuation	Place punctuation inside closing quotation marks.
packages/hashicorp_vault/docs/README.md	602	Elastic.QuotesPunctuation	Place punctuation inside closing quotation marks.
packages/hashicorp_vault/docs/README.md	602	Elastic.QuotesPunctuation	Place punctuation inside closing quotation marks.
packages/hashicorp_vault/docs/README.md	615	Elastic.Latinisms	Latin terms and abbreviations are a common source of confusion. Use 'for example' instead of 'e.g'.
packages/ibmmq/docs/README.md	602	Elastic.BritishSpellings	Use American English spelling 'acknowledgment' instead of British English 'acknowledgement'.
packages/ibmmq/docs/README.md	602	Elastic.BritishSpellings	Use American English spelling 'acknowledgment' instead of British English 'acknowledgement'.
packages/ibmmq/docs/README.md	603	Elastic.BritishSpellings	Use American English spelling 'acknowledgment' instead of British English 'acknowledgement'.
packages/ibmmq/docs/README.md	603	Elastic.BritishSpellings	Use American English spelling 'acknowledgment' instead of British English 'acknowledgement'.
packages/ibmmq_otel/docs/README.md	34	Elastic.Latinisms	Latin terms and abbreviations are a common source of confusion. Use 'for example' instead of 'e.g'.
packages/ibmmq_otel/docs/README.md	36	Elastic.Latinisms	Latin terms and abbreviations are a common source of confusion. Use 'for example' instead of 'e.g'.
packages/ibmmq_otel/docs/README.md	37	Elastic.Latinisms	Latin terms and abbreviations are a common source of confusion. Use 'for example' instead of 'e.g'.
packages/lmd/docs/README.md	21	Elastic.MenuArrows	Use '→' to separate menu items, not '' or '='. Example: Select Manage index → Add lifecycle policy.
packages/lmd/docs/README.md	21	Elastic.MenuArrows	Use '→' to separate menu items, not '' or '='. Example: Select Manage index → Add lifecycle policy.
packages/lmd/docs/README.md	51	Elastic.MenuArrows	Use '→' to separate menu items, not '' or '='. Example: Select Manage index → Add lifecycle policy.
packages/lmd/docs/README.md	65	Elastic.DirectionalLanguage	Don't use directional language. Use 'the following steps' instead of 'the below steps'.
packages/lmd/docs/README.md	68	Elastic.MenuArrows	Use '→' to separate menu items, not '' or '='. Example: Select Manage index → Add lifecycle policy.
packages/lmd/docs/README.md	71	Elastic.DirectionalLanguage	Don't use directional language. Use 'the label of the element' instead of 'on the right side'.
packages/lmd/docs/README.md	82	Elastic.DirectionalLanguage	Don't use directional language. Use 'the following steps' instead of 'the below steps'.
packages/lmd/docs/README.md	163	Elastic.DirectionalLanguage	Don't use directional language. Use 'the following element' instead of 'the steps below'.
packages/lmd/docs/README.md	182	Elastic.DirectionalLanguage	Don't use directional language. Use 'in the following section' instead of 'outlined below'.
packages/lmd/docs/README.md	185	Elastic.DirectionalLanguage	Don't use directional language. Use 'in the following section' instead of 'listed below'.
packages/lmd/docs/README.md	255	Elastic.DirectionalLanguage	Don't use directional language. Use 'the following element' instead of 'section below'.
packages/lyve_cloud/_dev/build/docs/README.md	20	Elastic.QuotesPunctuation	Place punctuation inside closing quotation marks.
packages/lyve_cloud/docs/README.md	20	Elastic.QuotesPunctuation	Place punctuation inside closing quotation marks.
packages/microsoft_intune/_dev/build/docs/README.md	23	Elastic.Latinisms	Latin terms and abbreviations are a common source of confusion. Use 'versus' instead of 'vs'.
packages/microsoft_intune/_dev/build/docs/README.md	32	Elastic.MenuArrows	Use '→' to separate menu items, not '' or '='. Example: Select Manage index → Add lifecycle policy.
packages/microsoft_intune/docs/README.md	23	Elastic.Latinisms	Latin terms and abbreviations are a common source of confusion. Use 'versus' instead of 'vs'.
packages/microsoft_intune/docs/README.md	32	Elastic.MenuArrows	Use '→' to separate menu items, not '' or '='. Example: Select Manage index → Add lifecycle policy.
packages/microsoft_sqlserver/docs/README.md	491	Elastic.Latinisms	Latin terms and abbreviations are a common source of confusion. Use 'and so on' instead of 'etc'.
packages/microsoft_sqlserver/docs/README.md	491	Elastic.DirectionalLanguage	Don't use directional language. Use 'earlier on this page' instead of 'noted above'.
packages/microsoft_sqlserver/docs/README.md	492	Elastic.DirectionalLanguage	Don't use directional language. Use 'earlier on this page' instead of 'noted above'.
packages/microsoft_sqlserver/docs/README.md	493	Elastic.QuotesPunctuation	Place punctuation inside closing quotation marks.
packages/nvidia_gpu_otel/docs/README.md	41	Elastic.Latinisms	Latin terms and abbreviations are a common source of confusion. Use 'for example' instead of 'e.g'.
packages/nvidia_gpu_otel/docs/README.md	42	Elastic.Latinisms	Latin terms and abbreviations are a common source of confusion. Use 'for example' instead of 'e.g'.
packages/nvidia_gpu_otel/docs/README.md	43	Elastic.Latinisms	Latin terms and abbreviations are a common source of confusion. Use 'for example' instead of 'e.g'.
packages/openai/_dev/build/docs/README.md	35	Elastic.MenuArrows	Use '→' to separate menu items, not '' or '='. Example: Select Manage index → Add lifecycle policy.
packages/openai/docs/README.md	35	Elastic.MenuArrows	Use '→' to separate menu items, not '' or '='. Example: Select Manage index → Add lifecycle policy.
packages/openai/docs/README.md	246	Elastic.Latinisms	Latin terms and abbreviations are a common source of confusion. Use 'and so on' instead of 'etc'.
packages/openai/docs/README.md	246	Elastic.DirectionalLanguage	Don't use directional language. Use 'earlier on this page' instead of 'noted above'.
packages/openai/docs/README.md	247	Elastic.DirectionalLanguage	Don't use directional language. Use 'earlier on this page' instead of 'noted above'.
packages/openai/docs/README.md	248	Elastic.QuotesPunctuation	Place punctuation inside closing quotation marks.
packages/openai/docs/README.md	249	Elastic.Latinisms	Latin terms and abbreviations are a common source of confusion. Use 'for example' instead of 'e.g'.
packages/openai/docs/README.md	250	Elastic.Latinisms	Latin terms and abbreviations are a common source of confusion. Use 'for example' instead of 'e.g'.
packages/oracle_otel/docs/README.md	156	Elastic.Latinisms	Latin terms and abbreviations are a common source of confusion. Use 'versus' instead of 'vs'.
packages/oracle_otel/docs/README.md	163	Elastic.Latinisms	Latin terms and abbreviations are a common source of confusion. Use 'versus' instead of 'vs'.
packages/oracle_otel/docs/README.md	255	Elastic.Latinisms	Latin terms and abbreviations are a common source of confusion. Use 'versus' instead of 'vs'.
packages/oracle_otel/docs/README.md	256	Elastic.Latinisms	Latin terms and abbreviations are a common source of confusion. Use 'versus' instead of 'vs'.
packages/oracle_otel/docs/README.md	270	Elastic.Latinisms	Latin terms and abbreviations are a common source of confusion. Use 'for example' instead of 'e.g'.
packages/oracle_otel/docs/README.md	274	Elastic.Latinisms	Latin terms and abbreviations are a common source of confusion. Use 'and so on' instead of 'etc'.
packages/oracle_otel/docs/README.md	288	Elastic.Latinisms	Latin terms and abbreviations are a common source of confusion. Use 'and so on' instead of 'etc'.
packages/osquery_manager/_dev/scripts/osquery-gen/README.md	7	Elastic.Latinisms	Latin terms and abbreviations are a common source of confusion. Use 'for example' instead of 'e.g'.
packages/pad/docs/README.md	13	Elastic.MenuArrows	Use '→' to separate menu items, not '' or '='. Example: Select Manage index → Add lifecycle policy.
packages/pad/docs/README.md	66	Elastic.MenuArrows	Use '→' to separate menu items, not '' or '='. Example: Select Manage index → Add lifecycle policy.
packages/pad/docs/README.md	66	Elastic.MenuArrows	Use '→' to separate menu items, not '' or '='. Example: Select Manage index → Add lifecycle policy.
packages/pad/docs/README.md	85	Elastic.MenuArrows	Use '→' to separate menu items, not '' or '='. Example: Select Manage index → Add lifecycle policy.
packages/pad/docs/README.md	96	Elastic.DirectionalLanguage	Don't use directional language. Use 'the following steps' instead of 'the below steps'.
packages/pad/docs/README.md	99	Elastic.MenuArrows	Use '→' to separate menu items, not '' or '='. Example: Select Manage index → Add lifecycle policy.
packages/pad/docs/README.md	102	Elastic.DirectionalLanguage	Don't use directional language. Use 'the label of the element' instead of 'on the right side'.
packages/pad/docs/README.md	137	Elastic.DirectionalLanguage	Don't use directional language. Use 'the following element' instead of 'the steps below'.
packages/pad/docs/README.md	156	Elastic.DirectionalLanguage	Don't use directional language. Use 'in the following section' instead of 'outlined below'.
packages/pad/docs/README.md	159	Elastic.DirectionalLanguage	Don't use directional language. Use 'in the following section' instead of 'listed below'.
packages/problemchild/docs/README.md	3	Elastic.DontUse	Don't use 'Please'.
packages/problemchild/docs/README.md	18	Elastic.MenuArrowsBold	Use '→' to separate menu items, not '' or '='. Example: Select Manage index → Add lifecycle policy.
packages/problemchild/docs/README.md	20	Elastic.MenuArrows	Use '→' to separate menu items, not '' or '='. Example: Select Manage index → Add lifecycle policy.
packages/problemchild/docs/README.md	144	Elastic.DirectionalLanguage	Don't use directional language. Use 'the following element' instead of 'the steps below'.
packages/problemchild/docs/README.md	163	Elastic.DirectionalLanguage	Don't use directional language. Use 'in the following section' instead of 'outlined below'.
packages/redisenterprise_otel/docs/README.md	35	Elastic.Latinisms	Latin terms and abbreviations are a common source of confusion. Use 'for example' instead of 'e.g'.
packages/redisenterprise_otel/docs/README.md	36	Elastic.Latinisms	Latin terms and abbreviations are a common source of confusion. Use 'for example' instead of 'e.g'.

💡 Suggestions (141)

File	Line	Rule	Message
docs/ci_pipelines.md	226	Elastic.Wordiness	Consider using 'to' instead of 'In order to'.
docs/extend/add-mapping.md	57	Elastic.Versions	Use 'earlier versions' instead of 'older versions' when referring to versions.
docs/extend/developer-workflow-fleet-UI.md	65	Elastic.Wordiness	Consider using 'to' instead of 'in order to'.
docs/extend/developer-workflow-import-beat.md	92	Elastic.WordChoice	Consider using 'efficiently' instead of 'simply', unless the term is in the UI.
docs/extend/general-guidelines.md	75	Elastic.Wordiness	Consider using 'consider' instead of 'take into account'.
packages/abnormal_security/_dev/build/docs/README.md	5	Elastic.WordChoice	Consider using 'atypical, not typical' instead of 'Abnormal', unless the term is in the UI.
packages/abnormal_security/_dev/build/docs/README.md	5	Elastic.WordChoice	Consider using 'misuse' instead of 'Abuse', unless the term is in the UI.
packages/abnormal_security/_dev/build/docs/README.md	14	Elastic.WordChoice	Consider using 'atypical, not typical' instead of 'Abnormal', unless the term is in the UI.
packages/abnormal_security/docs/README.md	5	Elastic.WordChoice	Consider using 'atypical, not typical' instead of 'Abnormal', unless the term is in the UI.
packages/abnormal_security/docs/README.md	5	Elastic.WordChoice	Consider using 'misuse' instead of 'Abuse', unless the term is in the UI.
packages/abnormal_security/docs/README.md	14	Elastic.WordChoice	Consider using 'atypical, not typical' instead of 'Abnormal', unless the term is in the UI.
packages/aws/docs/securityhub.md	1386	Elastic.Wordiness	Consider using 'tell' instead of 'inform'.
packages/aws/docs/securityhub.md	1386	Elastic.WordChoice	Consider using 'can, might' instead of 'may', unless the term is in the UI.
packages/aws/docs/securityhub.md	1386	Elastic.WordChoice	Consider using 'can, might' instead of 'may', unless the term is in the UI.
packages/beaconing/docs/README.md	39	Elastic.Wordiness	Consider using 'if' instead of 'In the event that'.
packages/beyondtrust_pra/docs/README.md	103	Elastic.WordChoice	Consider using 'can, might' instead of 'may', unless the term is in the UI.
packages/beyondtrust_pra/docs/README.md	129	Elastic.WordChoice	Consider using 'can, might' instead of 'may', unless the term is in the UI.
packages/bitwarden/_dev/build/docs/README.md	16	Elastic.OxfordComma	Use the Oxford comma in 'Groups, Members and Policies.'.
packages/bitwarden/docs/README.md	16	Elastic.OxfordComma	Use the Oxford comma in 'Groups, Members and Policies.'.
packages/blacklens/docs/README.md	153	Elastic.Wordiness	Consider using 'tell' instead of 'inform'.
packages/blacklens/docs/README.md	153	Elastic.WordChoice	Consider using 'can, might' instead of 'may', unless the term is in the UI.
packages/blacklens/docs/README.md	153	Elastic.WordChoice	Consider using 'can, might' instead of 'may', unless the term is in the UI.
packages/cato_networks/_dev/build/docs/README.md	111	Elastic.WordChoice	Consider using 'can, might' instead of 'may', unless the term is in the UI.
packages/cato_networks/_dev/build/docs/README.md	113	Elastic.WordChoice	Consider using 'can, might' instead of 'may', unless the term is in the UI.
packages/cisco_nexus/docs/README.md	378	Elastic.Wordiness	Consider using 'tell' instead of 'inform'.
packages/cisco_nexus/docs/README.md	378	Elastic.WordChoice	Consider using 'can, might' instead of 'may', unless the term is in the UI.
packages/cisco_nexus/docs/README.md	378	Elastic.WordChoice	Consider using 'can, might' instead of 'may', unless the term is in the UI.
packages/cisco_nexus/docs/README.md	380	Elastic.WordChoice	Consider using 'can, might' instead of 'may', unless the term is in the UI.
packages/cisco_nexus/docs/README.md	380	Elastic.WordChoice	Consider using 'deactivated, deselected, hidden, turned off, unavailable' instead of 'disabled', unless the term is in the UI.
packages/cisco_nexus/docs/README.md	381	Elastic.WordChoice	Consider using 'efficiently' instead of 'simply', unless the term is in the UI.
packages/cisco_nexus/docs/README.md	381	Elastic.WordChoice	Consider using 'can, might' instead of 'may', unless the term is in the UI.
packages/cisco_nexus/docs/README.md	383	Elastic.WordChoice	Consider using 'can, might' instead of 'may', unless the term is in the UI.
packages/cisco_nexus/docs/README.md	394	Elastic.WordChoice	Consider using 'can, might' instead of 'may', unless the term is in the UI.
packages/cisco_nexus/docs/README.md	408	Elastic.Wordiness	Consider using 'all' instead of 'All of '.
packages/cloud_defend/docs/README.md	474	Elastic.WordChoice	Consider using 'start, run' instead of 'boot', unless the term is in the UI.
packages/cursor/docs/README.md	116	Elastic.WordChoice	Consider using 'deactivated, deselected, hidden, turned off, unavailable' instead of 'disabled', unless the term is in the UI.
packages/cursor/docs/README.md	151	Elastic.WordChoice	Consider using 'deactivate, deselect, hide, turn off' instead of 'disable', unless the term is in the UI.
packages/cursor/docs/README.md	192	Elastic.WordChoice	Consider using 'can, might' instead of 'may', unless the term is in the UI.
packages/cursor/docs/README.md	198	Elastic.Wordiness	Consider using 'tell' instead of 'inform'.
packages/cursor/docs/README.md	198	Elastic.WordChoice	Consider using 'can, might' instead of 'may', unless the term is in the UI.
packages/cursor/docs/README.md	198	Elastic.WordChoice	Consider using 'can, might' instead of 'may', unless the term is in the UI.
packages/cursor/docs/README.md	200	Elastic.WordChoice	Consider using 'can, might' instead of 'may', unless the term is in the UI.
packages/cursor/docs/README.md	200	Elastic.WordChoice	Consider using 'deactivated, deselected, hidden, turned off, unavailable' instead of 'disabled', unless the term is in the UI.
packages/cursor/docs/README.md	201	Elastic.WordChoice	Consider using 'efficiently' instead of 'simply', unless the term is in the UI.
packages/cursor/docs/README.md	201	Elastic.WordChoice	Consider using 'can, might' instead of 'may', unless the term is in the UI.
packages/cursor/docs/README.md	206	Elastic.Wordiness	Consider using 'all' instead of 'All of '.
packages/cursor/docs/README.md	221	Elastic.Wordiness	Consider using 'sometimes' instead of 'In some cases'.
packages/cursor/docs/README.md	221	Elastic.WordChoice	Consider using 'can, might' instead of 'may', unless the term is in the UI.
packages/cursor/docs/README.md	224	Elastic.WordChoice	Consider using 'can, might' instead of 'may', unless the term is in the UI.
packages/cursor/docs/README.md	391	Elastic.WordChoice	Consider using 'can, might' instead of 'may', unless the term is in the UI.
packages/dataminr_pulse/README.md	59	Elastic.Versions	Use 'or later' instead of 'or newer' when referring to versions.
packages/dataminr_pulse/README.md	60	Elastic.Versions	Use 'or later' instead of 'or newer' when referring to versions.
packages/dataminr_pulse/README.md	61	Elastic.Versions	Use 'or later' instead of 'or newer' when referring to versions.
packages/dataminr_pulse/README.md	62	Elastic.Versions	Use 'or later' instead of 'or higher' when referring to versions.
packages/dataminr_pulse/docs/README.md	59	Elastic.Versions	Use 'or later' instead of 'or newer' when referring to versions.
packages/dataminr_pulse/docs/README.md	60	Elastic.Versions	Use 'or later' instead of 'or newer' when referring to versions.
packages/dataminr_pulse/docs/README.md	61	Elastic.Versions	Use 'or later' instead of 'or newer' when referring to versions.
packages/dataminr_pulse/docs/README.md	62	Elastic.Versions	Use 'or later' instead of 'or higher' when referring to versions.
packages/ded/docs/README.md	48	Elastic.Wordiness	Consider using 'if' instead of 'In the event that'.
packages/dga/docs/README.md	5	Elastic.Wordiness	Consider using 'before' instead of 'Prior to'.
packages/dga/docs/README.md	84	Elastic.Repetition	"Detection" is repeated.
packages/docker/_dev/build/docs/README.md	81	Elastic.WordChoice	Consider using 'can, might' instead of 'may', unless the term is in the UI.
packages/docker/_dev/build/docs/README.md	83	Elastic.WordChoice	Consider using 'can, might' instead of 'may', unless the term is in the UI.
packages/docker/docs/README.md	366	Elastic.WordChoice	Consider using 'can, might' instead of 'may', unless the term is in the UI.
packages/docker/docs/README.md	368	Elastic.WordChoice	Consider using 'can, might' instead of 'may', unless the term is in the UI.
packages/elasticsearch/docs/README.md	289	Elastic.WordChoice	Consider using 'can, might' instead of 'may', unless the term is in the UI.
packages/elasticsearch/docs/README.md	308	Elastic.WordChoice	Consider using 'select, press, visits' instead of 'hit', unless the term is in the UI.
packages/elasticsearch/docs/README.md	336	Elastic.Wordiness	Consider using 'tell' instead of 'inform'.
packages/elasticsearch/docs/README.md	336	Elastic.WordChoice	Consider using 'can, might' instead of 'may', unless the term is in the UI.
packages/elasticsearch/docs/README.md	336	Elastic.WordChoice	Consider using 'can, might' instead of 'may', unless the term is in the UI.
packages/elasticsearch/docs/README.md	338	Elastic.WordChoice	Consider using 'can, might' instead of 'may', unless the term is in the UI.
packages/elasticsearch/docs/README.md	338	Elastic.WordChoice	Consider using 'deactivated, deselected, hidden, turned off, unavailable' instead of 'disabled', unless the term is in the UI.
packages/elasticsearch/docs/README.md	339	Elastic.WordChoice	Consider using 'efficiently' instead of 'simply', unless the term is in the UI.
packages/elasticsearch/docs/README.md	339	Elastic.WordChoice	Consider using 'can, might' instead of 'may', unless the term is in the UI.
packages/elasticsearch/docs/README.md	345	Elastic.WordChoice	Consider using 'can, might' instead of 'may', unless the term is in the UI.
packages/envoyproxy_otel/docs/README.md	31	Elastic.Semicolons	Use semicolons judiciously.
packages/eset_protect/docs/README.md	580	Elastic.Wordiness	Consider using 'whether' instead of 'Whether or not'.
packages/fim/docs/README.md	135	Elastic.WordChoice	Consider using 'can, might' instead of 'may', unless the term is in the UI.
packages/fim/docs/README.md	141	Elastic.Wordiness	Consider using 'tell' instead of 'inform'.
packages/fim/docs/README.md	141	Elastic.WordChoice	Consider using 'can, might' instead of 'may', unless the term is in the UI.
packages/fim/docs/README.md	141	Elastic.WordChoice	Consider using 'can, might' instead of 'may', unless the term is in the UI.
packages/fim/docs/README.md	143	Elastic.WordChoice	Consider using 'efficiently' instead of 'simply', unless the term is in the UI.
packages/fim/docs/README.md	143	Elastic.WordChoice	Consider using 'can, might' instead of 'may', unless the term is in the UI.
packages/fim/docs/README.md	146	Elastic.WordChoice	Consider using 'run, start' instead of 'execute', unless the term is in the UI.
packages/fim/docs/README.md	151	Elastic.WordChoice	Consider using 'can, might' instead of 'may', unless the term is in the UI.
packages/forescout/docs/README.md	113	Elastic.Wordiness	Consider using 'tell' instead of 'inform'.
packages/forescout/docs/README.md	113	Elastic.WordChoice	Consider using 'can, might' instead of 'may', unless the term is in the UI.
packages/forescout/docs/README.md	113	Elastic.WordChoice	Consider using 'can, might' instead of 'may', unless the term is in the UI.
packages/forescout/docs/README.md	127	Elastic.WordChoice	Consider using 'can, might' instead of 'may', unless the term is in the UI.
packages/forescout/docs/README.md	134	Elastic.WordChoice	Consider using 'can, might' instead of 'may', unless the term is in the UI.
packages/fortinet_fortigate/docs/README.md	855	Elastic.Wordiness	Consider using 'sometimes' instead of 'In some cases'.
packages/fortinet_fortigate/docs/README.md	855	Elastic.WordChoice	Consider using 'can, might' instead of 'may', unless the term is in the UI.
packages/fortinet_fortigate/docs/README.md	859	Elastic.WordChoice	Consider using 'can, might' instead of 'may', unless the term is in the UI.
packages/github/_dev/build/docs/README.md	116	Elastic.WordChoice	Consider using 'can, might' instead of 'may', unless the term is in the UI.
packages/github/docs/README.md	240	Elastic.Wordiness	Consider using 'tell' instead of 'inform'.
packages/github/docs/README.md	240	Elastic.WordChoice	Consider using 'can, might' instead of 'may', unless the term is in the UI.
packages/github/docs/README.md	240	Elastic.WordChoice	Consider using 'can, might' instead of 'may', unless the term is in the UI.
packages/github/docs/README.md	419	Elastic.Wordiness	Consider using 'tell' instead of 'inform'.
packages/github/docs/README.md	419	Elastic.WordChoice	Consider using 'can, might' instead of 'may', unless the term is in the UI.
packages/github/docs/README.md	419	Elastic.WordChoice	Consider using 'can, might' instead of 'may', unless the term is in the UI.
packages/github/docs/README.md	575	Elastic.Wordiness	Consider using 'tell' instead of 'inform'.
packages/github/docs/README.md	575	Elastic.WordChoice	Consider using 'can, might' instead of 'may', unless the term is in the UI.
packages/github/docs/README.md	575	Elastic.WordChoice	Consider using 'can, might' instead of 'may', unless the term is in the UI.
packages/github/docs/README.md	808	Elastic.Wordiness	Consider using 'tell' instead of 'inform'.
packages/github/docs/README.md	808	Elastic.WordChoice	Consider using 'can, might' instead of 'may', unless the term is in the UI.
packages/github/docs/README.md	808	Elastic.WordChoice	Consider using 'can, might' instead of 'may', unless the term is in the UI.
packages/github/docs/README.md	1030	Elastic.WordChoice	Consider using 'can, might' instead of 'may', unless the term is in the UI.
packages/kubernetes_otel/docs/README.md	45	Elastic.WordChoice	Consider using 'can, might' instead of 'may', unless the term is in the UI.
packages/kubernetes_otel/docs/README.md	57	Elastic.WordChoice	Consider using 'can, might' instead of 'may', unless the term is in the UI.
packages/kubernetes_otel/docs/README.md	65	Elastic.WordChoice	Consider using 'can, might' instead of 'may', unless the term is in the UI.
packages/kubernetes_otel/docs/README.md	89	Elastic.WordChoice	Consider using 'can, might' instead of 'May', unless the term is in the UI.
packages/lmd/docs/README.md	57	Elastic.Wordiness	Consider using 'if' instead of 'In the event that'.
packages/lmd/docs/README.md	82	Elastic.Clone	Use `Clone` only when referring to cloning a GitHub repository or creating a copy that is linked to the original. Often confused with 'copy' and 'duplicate'.
packages/microsoft_exchange_online_message_trace/_dev/build/docs/README.md	36	Elastic.WordChoice	Consider using 'can, might' instead of 'may', unless the term is in the UI.
packages/microsoft_exchange_online_message_trace/docs/README.md	36	Elastic.WordChoice	Consider using 'can, might' instead of 'may', unless the term is in the UI.
packages/microsoft_sentinel/docs/README.md	191	Elastic.Wordiness	Consider using 'tell' instead of 'inform'.
packages/microsoft_sentinel/docs/README.md	191	Elastic.WordChoice	Consider using 'can, might' instead of 'may', unless the term is in the UI.
packages/microsoft_sentinel/docs/README.md	191	Elastic.WordChoice	Consider using 'can, might' instead of 'may', unless the term is in the UI.
packages/microsoft_sentinel/docs/README.md	253	Elastic.Wordiness	Consider using 'tell' instead of 'inform'.
packages/microsoft_sentinel/docs/README.md	253	Elastic.WordChoice	Consider using 'can, might' instead of 'may', unless the term is in the UI.
packages/microsoft_sentinel/docs/README.md	253	Elastic.WordChoice	Consider using 'can, might' instead of 'may', unless the term is in the UI.
packages/microsoft_sentinel/docs/README.md	434	Elastic.Wordiness	Consider using 'tell' instead of 'inform'.
packages/microsoft_sentinel/docs/README.md	434	Elastic.WordChoice	Consider using 'can, might' instead of 'may', unless the term is in the UI.
packages/microsoft_sentinel/docs/README.md	434	Elastic.WordChoice	Consider using 'can, might' instead of 'may', unless the term is in the UI.
packages/microsoft_sqlserver/docs/README.md	501	Elastic.WordChoice	Consider using 'select, press, visits' instead of 'hit', unless the term is in the UI.
packages/microsoft_sqlserver_otel/docs/README.md	26	Elastic.Semicolons	Use semicolons judiciously.
packages/microsoft_sqlserver_otel/docs/README.md	103	Elastic.WordChoice	Consider using 'select, press, visits' instead of 'Hit', unless the term is in the UI.
packages/mongodb_otel/docs/README.md	81	Elastic.Semicolons	Use semicolons judiciously.
packages/nvidia_gpu_otel/docs/README.md	105	Elastic.WordChoice	Consider using 'start, run' instead of 'boot', unless the term is in the UI.
packages/oracle_otel/docs/README.md	84	Elastic.WordChoice	Consider using 'deactivated, deselected, hidden, turned off, unavailable' instead of 'disabled', unless the term is in the UI.
packages/oracle_otel/docs/README.md	201	Elastic.Semicolons	Use semicolons judiciously.
packages/oracle_otel/docs/README.md	238	Elastic.WordChoice	Consider using 'select, press, visits' instead of 'hit', unless the term is in the UI.
packages/oracle_otel/docs/README.md	257	Elastic.WordChoice	Consider using 'select, press, visits' instead of 'hit', unless the term is in the UI.
packages/oracle_otel/docs/README.md	257	Elastic.WordChoice	Consider using 'select, press, visits' instead of 'hit', unless the term is in the UI.
packages/oracle_otel/docs/README.md	270	Elastic.WordChoice	Consider using 'can, might' instead of 'may', unless the term is in the UI.
packages/oracle_otel/docs/README.md	288	Elastic.WordChoice	Consider using 'can, might' instead of 'may', unless the term is in the UI.
packages/osquery_manager/artifacts_matrix.md	40	Elastic.WordChoice	Consider using 'open' instead of 'launch', unless the term is in the UI.
packages/osquery_manager/artifacts_matrix.md	217	Elastic.WordChoice	Consider using 'deactivated, deselected, hidden, turned off, unavailable' instead of 'Disabled', unless the term is in the UI.
packages/pad/docs/README.md	92	Elastic.Wordiness	Consider using 'if' instead of 'In the event that'.
packages/problemchild/docs/README.md	126	Elastic.Repetition	"Detection" is repeated.
packages/redisenterprise_otel/docs/README.md	119	Elastic.WordChoice	Consider using 'can, might' instead of 'may', unless the term is in the UI.

The Vale linter checks documentation changes against the Elastic Docs style guide.

To use Vale locally or report issues, refer to Elastic style guide for Vale.

elasticmachine · 2026-05-25T08:08:59Z

💔 Build Failed

Buildkite Build
Commit: e94202b

Failed CI Steps

History

elastic-vault-github-plugin-prod · 2026-05-25T11:22:19Z

🚀 Benchmarks report

To see the full report comment with /test benchmark fullreport

github-actions · 2026-05-25T11:27:55Z

TL;DR

Both failing Buildkite jobs (Check integrations kubernetes and Check integrations netbox) exited with status 1, but the provided step logs only contain teardown/artifact-upload output and do not include the actual failing command/test lines. The immediate next action is to fetch the failing JUnit artifact(s) or full raw step log to identify the true root cause.

Remediation

Re-run the two failed jobs (or open the Buildkite artifact list for this run) and inspect the failing JUnit XML(s), especially:
- build/test-results/netbox-system-1779696521532508743.xml
- build/test-results/kubernetes-static-1779696460040571839.xml
Post the first failing test/error block from those XML files (or the full pre-teardown step logs) so the exact code/config fix can be pinpointed.

Investigation details

Root Cause

Inconclusive with current data. The available logs start at stack teardown and end at artifact upload/cleanup, so they do not contain the underlying failure message.

Evidence

Build: https://buildkite.com/elastic/integrations/builds/43414
Job/step: Check integrations kubernetes
Key log excerpt (/tmp/gh-aw/buildkite-logs/integrations-check-integrations-kubernetes.txt):
- --- [kubernetes] failed
- 🚨 Error: The command exited with status 1
- then immediate artifact upload + cleanup
Job/step: Check integrations netbox
Key log excerpt (/tmp/gh-aw/buildkite-logs/integrations-check-integrations-netbox.txt):
- --- [netbox] failed
- 🚨 Error: The command exited with status 1
- then immediate artifact upload + cleanup

Verification

Not run locally against PR head, because the PR metadata/diff was unavailable in this environment and the failure logs do not include the originating error output.

Follow-up

Once the failing XML/log excerpt is available, this can be classified precisely (test failure vs code/config/dependency) and mapped to exact file/line changes.

Note

🔒 Integrity filter blocked 2 items

The following items were blocked because they don't meet the GitHub integrity level.

[Cato Networks] Sync feature branch with main branch #19182 pull_request_read: has lower integrity than agent requires. The agent cannot read data with integrity below "approved".
#19182 pull_request_read: has lower integrity than agent requires. The agent cannot read data with integrity below "approved".

To allow these resources, lower min-integrity in your GitHub frontmatter:

tools:
  github:
    min-integrity: approved  # merged | approved | unapproved | none

What is this? | From workflow: PR Buildkite Detective

Give us feedback! React with 🚀 if perfect, 👍 if helpful, 👎 if not.

botelastic · 2026-06-24T12:23:06Z

Hi! We just realized that we haven't looked into this PR in a while. We're sorry! We're labeling this issue as Stale to make it hit our filters and make sure we get back to it as soon as possible. In the meantime, it'd be extremely helpful if you could take a look at it as well and confirm its relevance. A simple comment with a nice emoji will be enough :+1. Thank you for your contribution!

botelastic · 2026-07-24T12:24:04Z

Hi! This PR has been stale for a while and we're going to close it as part of our cleanup procedure. We appreciate your contribution and would like to apologize if we have not been able to review it, due to the current heavy load of the team. Feel free to re-open this PR if you think it should stay open and is worth rebasing. Thank you for your contribution!

efd6 and others added 30 commits April 16, 2026 06:16

Agentless hello world add metrics (elastic#18228)

0015dec

* Update integration with mock metrics counter * Fix system tests * Update readme * Apply review suggestions * Limit max eps that can be generated by the integration to 200 * Fix review comments

[updatecli] Update latest snapshot to 8.19.14-SNAPSHOT (elastic#18418)

f09763d

* chore: [updatecli] [weekly] Update latest snapshot to 8.19.14-SNAPSHOT Made with ❤️️ by updatecli --------- Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>

[system_otel] Remove host.ip and host.mac (elastic#18390)

18325f2

* Remove host.ip and host.mac * update pr number

[fim] Add etw backend to fim (elastic#18420)

fbeb099

* Add etw backend to fim * Update description

chore: update pkgs in .github/ISSUE_TEMPLATE/integration_*.yml (elast…

d183109

…ic#18440) Made with ❤️️ by updatecli Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>

[aws_lambda] enable agentless deployment for aws lambda metrics (elas…

804eb9d

…tic#18361) * [aws_lambda] enable agentless deployment for aws lambda metrics * add pr link * update readme * update readme

docs: update agent-version-conditions doc (elastic#18430)

33ca9ab

* update agent-version-conditions doc * fix linting

[aws_securityhub] Promote to GA — 1.0.0 (elastic#18133)

6b7f7ff

[aws_elb] enable agentless deployment for aws elb metrics (elastic#18364

dec3355

) * [aws_elb] enable agentless deployment for aws elb metrics * add pr link * add readme note * fix review comments * increment version * update readme * bump version

[aws_sqs] enable agentless deployment for aws sqs metrics (elastic#18366

3a82e3e

) * [aws_sqs] enable agentless deployment for aws sqs metrics * update readme * update pr link

[aws_health] enable agentless deployment for aws health metrics (elas…

8e45e97

…tic#18362) * [aws] enable agentless deployment for aws health metrics * add pr link * update readme

[aws_billing] enable agentless deployment for aws billing metrics (el…

0b78722

…astic#18363) * [aws_billing] agentless deployment for aws billing metrics * add pr link * update readme

[aws_transitgateway] enable agentless deployment (elastic#18389)

65ccdd2

* [aws_transitgateway] enable agentless deployment for aws transitgateway metrics * add pr link * update readme

[Github] Add agentless deployement (elastic#18270)

3c7c959

github: add agentless deployment

[aws_sns] enable agentless deployment for aws sns metrics (elastic#18365

08b64df

) * [aws_sns] enable agentless deployment for aws sns metrics * add pr link * update readme * bump version * bump version

chore: update pkgs in .github/ISSUE_TEMPLATE/integration_*.yml (elast…

bdab02c

…ic#18532) Made with ❤️️ by updatecli Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>

kcreddy and others added 16 commits May 22, 2026 09:01

Fix section title typo in APM dashboard (elastic#19150)

e0a9d98

* Fix section title typo in apm dashboard * Apply suggestions from code review Co-authored-by: Carson Ip <carsonip@users.noreply.github.com> --------- Co-authored-by: Carson Ip <carsonip@users.noreply.github.com>

[CI][docs] Fix typos in messages and docs (elastic#19120)

fa9a16d

Use Vale actions from docs-actions (elastic#19142)

e1e0036

Point the Vale lint and report workflows at the migrated docs-actions action paths so integrations follows the new shared location. Co-authored-by: GPT-5.5 <gpt-5.5@openai.com> Co-authored-by: Cursor <cursoragent@cursor.com>

[Pfsense] Adds null checks before calling .toLowerCase() on `ctx._t…

651caee

…mp?.action` within the php-fpm ingest pipeline. (elastic#19033)

[checkpoint] Change fingerprint creation (elastic#16918)

13106aa

The fields originally chosen for fingerprinting do not create a unique fingerprint. The new fields create a more unique fingerprint. --------- Co-authored-by: Ilya Nikokoshev <ilya.nikokoshev@elastic.co>

Use standardized OTel Naming convention (elastic#19175)

5b943ae

* Use standardized OTel Naming convention * update changelog

[Cato Networks] Update changelog, version in manifest and Sync CODEOW…

e94202b

…NERS (elastic#19158) Update changelog entry, manifest version and sync CODEOWNERS file with main branch. --------- Co-authored-by: sharadcrest <sharad.kevadiya@crestdata.ai>

github-actions Bot mentioned this pull request May 25, 2026

[cloudflare_logpush] fix conflicts in feature branch #19186

Closed

andrewkroh added the needs CLA User must sign the Elastic Contributor License before review. label May 25, 2026

This was referenced May 25, 2026

[breaking-change] Undocumented breaking changes detected (2026-05-25) #19189

Open

[docs-patrol] Update Okta README for OIN authentication flow #19236

Open

botelastic Bot added the Stalled label Jun 24, 2026

botelastic Bot closed this Jul 24, 2026

sharad-elastic deleted the sync-main-for-cato_networks branch August 21, 2026 06:58

Navigation Menu

Repository navigation

[Cato Networks] Sync feature branch with main branch - #19182

[Cato Networks] Sync feature branch with main branch#19182
sharad-elastic wants to merge 408 commits into
elastic:feature/cato_networks-0.1.0from
sharad-elastic:sync-main-for-cato_networks

sharad-elastic commented May 25, 2026

Uh oh!

cla-checker-service Bot commented May 25, 2026

Uh oh!

github-actions Bot commented May 25, 2026

Uh oh!

elasticmachine commented May 25, 2026 •

edited

Loading

Uh oh!

elastic-vault-github-plugin-prod Bot commented May 25, 2026

Uh oh!

github-actions Bot commented May 25, 2026

Root Cause

Evidence

Verification

Follow-up

Uh oh!

botelastic Bot commented Jun 24, 2026

Uh oh!

botelastic Bot commented Jul 24, 2026

Uh oh!

Reviewers

Uh oh!

Assignees

Labels

Projects

Milestone

Development

Uh oh!

20 participants

Conversation

sharad-elastic commented May 25, 2026

Proposed commit message

Uh oh!

cla-checker-service Bot commented May 25, 2026

Uh oh!

github-actions Bot commented May 25, 2026

Vale Linting Results

Uh oh!

elasticmachine commented May 25, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

💔 Build Failed

Failed CI Steps

History

Uh oh!

elastic-vault-github-plugin-prod Bot commented May 25, 2026

🚀 Benchmarks report

Uh oh!

github-actions Bot commented May 25, 2026

TL;DR

Remediation

Root Cause

Evidence

Verification

Follow-up

Uh oh!

botelastic Bot commented Jun 24, 2026

Uh oh!

botelastic Bot commented Jul 24, 2026

Uh oh!

Reviewers

Uh oh!

Assignees

Labels

Projects

Milestone

Development

Uh oh!

20 participants

elasticmachine commented May 25, 2026 •

edited

Loading