Issues

• [ti_*] Add is_ioc_transform_source label so Threat Intel rules skip raw indices

  bugfixdocumentationIntegration:ti_cyware_intel_exchangeIntegration:ti_flashpointIntegration:ti_google_threat_intelligenceIntegration:ti_greynoiseTeam:SDE-CrestTeam:Security-Service Integrations
  Unread
  elastic/integrations#22249·sharad-elastic opened Oct 30, 2026 · Updated Oct 30, 2026
  10

  

• [Google Threat Intelligence] Discussion: replace the package's detection rules with Elastic's built-in Threat Intel Indicator Match rules

  discussIntegration:ti_google_threat_intelligenceTeam:Security-Service Integrations
  elastic/integrations#22150 · Filter by author kcreddy opened on Oct 23, 2026
  1

• [Google Threat Intelligence] Document the overlap between package detection rules and Elastic's built-in Threat Intel Indicator Match rules

  documentationIntegration:ti_google_threat_intelligenceTeam:SDE-CrestTeam:Security-Service Integrations
  elastic/integrations#22149 · Filter by author kcreddy opened on Oct 23, 2026
  1

  

• [Google Threat Intelligence] Align package detection rule mappings with Elastic's built-in Threat Intel Indicator Match rules

  enhancementIntegration:ti_google_threat_intelligenceTeam:SDE-CrestTeam:Security-Service Integrations
  elastic/integrations#22148 · Filter by author kcreddy opened on Oct 23, 2026
  1

  

• Some ti_*: Source IOC data streams are matched by the built-in Threat Intel Indicator Match rules

  bugIntegration:ti_cyware_intel_exchangeIntegration:ti_flashpointIntegration:ti_google_threat_intelligenceIntegration:ti_greynoiseTeam:SDE-CrestTeam:Security-Service Integrations
  elastic/integrations#22147 · Filter by author kcreddy opened on Oct 23, 2026
  1

  

• [Google Threat Intel] Ingest Digital Threat Monitoring and General Alerts

  Integration:ti_google_threat_intelligenceTeam:SDE-CrestTeam:Security-Service Integrations
  elastic/integrations#22066 · Filter by author jamiehynds opened on Oct 19, 2026
  2

  

• [Google Threat Intelligence]: Add data stream for the file feed

  enhancementIntegration:ti_google_threat_intelligencemaintainer:Partnerneeds:triageTeam:SDE-CrestTeam:Security-Service Integrations
  elastic/integrations#21077 · Filter by author jamiehynds opened on Sep 4, 2026
  10

  

• [33 integrations] Downgrade format_version if possible

  bugIntegration:abnormal_securityIntegration:armisIntegration:authentikIntegration:beyondinsight_password_safeIntegration:beyondtrust_praIntegration:carbon_black_cloudIntegration:checkpoint_emailIntegration:claroty_ctdIntegration:claroty_xdomeIntegration:cyberark_epmIntegration:extrahopIntegration:first_epssIntegration:google_secopsIntegration:imperva_cloud_wafIntegration:microsoft_sentinelIntegration:mimecastIntegration:nozomi_networksIntegration:proofpoint_itmIntegration:qualys_gavIntegration:servicenowIntegration:splunkIntegration:spycloudIntegration:statsd_inputIntegration:sublime_securityIntegration:sysdigIntegration:ti_customIntegration:ti_domaintoolsIntegration:ti_google_threat_intelligenceIntegration:ti_greynoiseIntegration:ti_recordedfutureIntegration:vectra_ruxIntegration:wizTeam:obs-ds-hosted-servicesTeam:SDE-CrestTeam:Security-Service Integrations
  elastic/integrations#15147 · Filter by author chrisberkhout opened on Sep 3, 2025
  9