Description

Building on the completion of Phases I and II, this Epic describes enabling agentless deployment for the next wave of security integrations - currently limited to httpjson and cel.

Security integrations targeted for Phase III release:

Edit 4.8.26 - removed akamai, entityanalytics_ad, entityanalytics_entra_id, entityanalytics_okta from the Phase III scope

Requirements

Following the established Phase I and II patterns, for each integration see the Onboarding Integration Guide.

1. Technical implementation

• Update integration manifest.yml to enable agentless deployment mode
• Update integration documentation with agentless deployment instructions
• Update changelog.md

Example reference: #13367

2. Performance documentation

• Test and document throughput in agentless (requires access to vendor environment and/or sample data)
• Document specific metrics for each integration. For example/where possible:
  • API response time: Average time for vendor API calls to complete
  • Events processed per minute: How many log entries/events the integration can handle
  • Error rates: Percentage of failed API calls or data processing errors
  • Container resource usage: CPU and memory consumption under typical load
  • Vendor-specific limits: Rate limiting thresholds and API quotas

Example documentation format: "Crowdstrike Falcon Intelligence: 200ms avg API response, 5,000 events/min, 0.1% error rate, 512MB RAM/0.5CPU, 1000 API calls/hour limit"

Dependencies

• Agentless infrastructure GA readiness (still in beta)
• Input compatibility: Currently agentless is optimized for httpjson and cel inputs

References

• https://github.com/elastic/security-team/issues/10092