Activity

1. moxarth-rathod

   self-assigned this

   on Jun 23, 2026
2. moxarth-rathod

   added

   enhancementNew feature or requestNew feature or request

   Team:Security-Service IntegrationsSecurity Service Integrations team [elastic/security-service-integrations]Security Service Integrations team [elastic/security-service-integrations]

   Integration:zerofoxZeroFox (Partner supported)ZeroFox (Partner supported)

   Team:SDE-CrestCrest developers on the Security Integrations team [elastic/sit-crest-contractors]Crest developers on the Security Integrations team [elastic/sit-crest-contractors]

   on Jun 23, 2026
3. moxarth-rathod

   added a parent issue on Jun 23, 2026

   • [Epic] Security Integrations | Agentless Support #17973
4. infra-vault-gh-plugin-prod commented on Jun 23, 2026

   

   infra-vault-gh-plugin-prodbot

   on Jun 23, 2026

   More actions

   Pinging @elastic/security-service-integrations (Team:Security-Service Integrations)
5. github-actions commented on Jun 23, 2026

   

   github-actionsbot

   on Jun 23, 2026 – with GitHub Actions

   Contributor

   More actions

   tl;dr: ZeroFox is a good Phase I agentless candidate; implement this as a manifest/docs/changelog change, with performance metrics left as follow-up work that needs a ZeroFox environment.

   Recommendation

   Enable agentless deployment for packages/zerofox by following the current Security Service integration pattern: add deployment_modes to the zerofox policy template, bump the package version and manifest format, add the standard agentless docs block, and add a changelog entry. I did not find evidence that stream/auth changes are required: the package is a single httpjson API polling integration.

   Findings

   Key ZeroFox facts:

   File	Evidence
   packages/zerofox/manifest.yml:3	Current package version is 1.29.0; this should be bumped for the enhancement.
   packages/zerofox/manifest.yml:6	Current format_version is 3.0.2; comparable current agentless packages use 3.3.2.
   packages/zerofox/manifest.yml:21-26	Single policy template named zerofox, with one httpjson input.
   packages/zerofox/manifest.yml:36-42	Request tracing is hidden from users (show_user: false) and should remain off by default for agentless.
   packages/zerofox/manifest.yml:50-57	Auth is a secret API token, compatible with remote API collection.
   packages/zerofox/manifest.yml:76-78	Owner is elastic/security-service-integrations, matching the agentless ownership metadata used by similar packages.
   packages/zerofox/data_stream/alerts/manifest.yml:1-7	The only data stream is logs/alerts and the only stream input is httpjson.
   packages/zerofox/data_stream/alerts/agent/stream/httpjson.yml.hbs:1-36	The stream performs API GET polling, sets the token header, paginates on body.next, and maintains a cursor.
   packages/zerofox/docs/README.md:1-7 and packages/zerofox/_dev/build/docs/README.md:1-7	Docs currently jump from the intro to Compatibility; there is no agentless section.
   packages/zerofox/changelog.yml:1-6	Top changelog entry is 1.29.0; add the new enhancement entry above it.

   Comparable current pattern:

   File	Evidence
   packages/bitwarden/manifest.yml:43-51	Uses deployment_modes.default.enabled: true and deployment_modes.agentless with enabled: true, release: beta, organization: security, division: engineering, team: security-service-integrations.
   packages/bitwarden/docs/README.md:9-12	Shows the standard “Agentless Enabled Integration” documentation block.
   packages/bitwarden/changelog.yml:8-11	Uses changelog wording “Enable Agentless deployment.”
   PR #13367	The issue’s reference PR enabled agentless for AWS Security Hub through manifest/docs/changelog changes.

   Related search results: no PR matched "[zerofox]" "Agentless"; the only issue search result for that query was this issue.

   Verification

   Local static search confirms ZeroFox does not already have agentless wiring in the relevant package files:

   $ rg -n "deployment_modes|agentless" packages/zerofox/{manifest.yml,docs/README.md,_dev/build/docs/README.md,changelog.yml}
   No matches found.
   

   elastic-package is not installed in this runner, so I could not run package validation here:

   $ command -v elastic-package || echo "elastic-package not installed"
   elastic-package not installed
   

   Detailed Action Plan

   1. Update packages/zerofox/manifest.yml:
      • bump version from 1.29.0 to 1.30.0;
      • bump format_version from 3.0.2 to the current agentless-compatible package format used by comparable packages, for example 3.3.2;
      • add this block under policy_templates[0] (name: zerofox) before inputs:

   deployment_modes:
     default:
       enabled: true
     agentless:
       enabled: true
       release: beta
       organization: security
       division: engineering
       team: security-service-integrations

   2. Update packages/zerofox/docs/README.md and regenerate/update packages/zerofox/_dev/build/docs/README.md with the standard block before ## Compatibility:

   ## Agentless Enabled Integration
   
   Agentless integrations allow you to collect data without having to manage Elastic Agent in your cloud. They make manual agent deployment unnecessary, so you can focus on your data instead of the agent that collects it. For more information, refer to [Agentless integrations](https://www.elastic.co/guide/en/serverless/current/security-agentless-integrations.html) and the [Agentless integrations FAQ](https://www.elastic.co/guide/en/serverless/current/agentless-integration-troubleshooting.html).
   Agentless deployments are only supported in Elastic Serverless and Elastic Cloud environments.  This functionality is in beta and is subject to change. Beta features are not subject to the support SLA of official GA features.

   3. Add a top entry to packages/zerofox/changelog.yml:

   - version: "1.30.0"
     changes:
       - description: Enable Agentless deployment.
         type: enhancement
         link: https://github.com/elastic/integrations/pull/<PR_NUMBER>

   4. Validate in a developer environment with elastic-package installed:

   cd packages/zerofox
   elastic-package build
   elastic-package check -v
   elastic-package test pipeline
   elastic-package test system
   

   5. For the performance requirement, collect and document metrics only after testing against a real ZeroFox/vendor environment or representative sample data: average API response time, events processed per minute, API/data processing error rate, container CPU/memory, and ZeroFox API quota/rate-limit behavior.

   Related Items

   Type	Item	Relevance
   Issue	#19700	Current ZeroFox agentless request.
   PR	#13367	Reference implementation linked by the issue; enabled agentless for AWS Security Hub.
   File	packages/zerofox/manifest.yml	Main implementation surface for deployment_modes, version, and format version.
   File	packages/zerofox/docs/README.md	Source docs that need the agentless section.
   File	packages/zerofox/_dev/build/docs/README.md	Generated docs currently missing the agentless section.
   File	packages/zerofox/changelog.yml	Needs the release entry.
   File	packages/bitwarden/manifest.yml	Current Security Service pattern including release: beta.

   ---

   What is this? | From workflow: Issue Triage

   Give us feedback! React with 🚀 if perfect, 👍 if helpful, 👎 if not.
6. moxarth-rathod

   closed this as completedin #19741on Jun 25, 2026