Skip to content

[ti_misp] Add agentless deployment #19702

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
moxarth-rathod merged 5 commits into from
Jun 29, 2026
Merged

[ti_misp] Add agentless deployment #19702

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
5 commits
Select commit Hold shift + click to select a range
68c5802
[ti_misp] Add agentless deployment
moxarth-rathod Jun 23, 2026
8404285
Add PR link to changelog
moxarth-rathod Jun 23, 2026
b006364
Merge branch 'main' into ti_misp-agentless
moxarth-rathod Jun 25, 2026
5173525
Merge branch 'main' into ti_misp-agentless
moxarth-rathod Jun 26, 2026
ba85294
Fix CI
moxarth-rathod Jun 29, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
5 changes: 5 additions & 0 deletions packages/ti_misp/_dev/build/docs/README.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -2,6 +2,11 @@

The MISP integration uses the [REST API from the running MISP instance](https://www.circl.lu/doc/misp/automation/#automation-api) to retrieve indicators and Threat Intelligence.

## Agentless Enabled Integration

Agentless integrations allow you to collect data without having to manage Elastic Agent in your cloud. They make manual agent deployment unnecessary, so you can focus on your data instead of the agent that collects it. For more information, refer to [Agentless integrations](https://www.elastic.co/guide/en/serverless/current/security-agentless-integrations.html) and the [Agentless integrations FAQ](https://www.elastic.co/guide/en/serverless/current/agentless-integration-troubleshooting.html).
Agentless deployments are only supported in Elastic Serverless and Elastic Cloud environments. This functionality is in beta and is subject to change. Beta features are not subject to the support SLA of official GA features.

## Logs

### Threat
Expand Down
5 changes: 5 additions & 0 deletions packages/ti_misp/changelog.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,4 +1,9 @@
# newer versions go on top
- version: "1.44.0"
changes:
- description: Enable Agentless deployment.
type: enhancement
link: https://github.com/elastic/integrations/pull/19702
- version: "1.43.1"
changes:
- description: Disable `X-Rate-Limit-*` response header parsing by default. The agent went DEGRADED on MISP instances that do not have rate limiting enabled. A new `enable_rate_limit_headers` toggle (default off) lets users opt in when their MISP role enforces rate limits.
Expand Down
3 changes: 2 additions & 1 deletion packages/ti_misp/data_stream/threat/elasticsearch/ingest_pipeline/default.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -28,8 +28,9 @@ processors:
description: 'Renames the original `message` field to `event.original` to store a copy of the original message. The `event.original` field is not touched if the document already has one; it may happen when Logstash sends the document.'
- remove:
field: message
tag: remove_message
ignore_missing: true
if: 'ctx.event?.original != null'
if: ctx.event?.original != null
description: 'The `message` field is no longer required if the document has an `event.original` field.'
- json:
field: event.original
Expand Down
3 changes: 2 additions & 1 deletion packages/ti_misp/data_stream/threat_attributes/elasticsearch/ingest_pipeline/default.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -28,8 +28,9 @@ processors:
description: 'Renames the original `message` field to `event.original` to store a copy of the original message. The `event.original` field is not touched if the document already has one; it may happen when Logstash sends the document.'
- remove:
field: message
tag: remove_message
ignore_missing: true
if: 'ctx.event?.original != null'
if: ctx.event?.original != null
description: 'The `message` field is no longer required if the document has an `event.original` field.'
- json:
field: event.original
Expand Down
5 changes: 5 additions & 0 deletions packages/ti_misp/docs/README.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -2,6 +2,11 @@

The MISP integration uses the [REST API from the running MISP instance](https://www.circl.lu/doc/misp/automation/#automation-api) to retrieve indicators and Threat Intelligence.

## Agentless Enabled Integration

Agentless integrations allow you to collect data without having to manage Elastic Agent in your cloud. They make manual agent deployment unnecessary, so you can focus on your data instead of the agent that collects it. For more information, refer to [Agentless integrations](https://www.elastic.co/guide/en/serverless/current/security-agentless-integrations.html) and the [Agentless integrations FAQ](https://www.elastic.co/guide/en/serverless/current/agentless-integration-troubleshooting.html).
Agentless deployments are only supported in Elastic Serverless and Elastic Cloud environments. This functionality is in beta and is subject to change. Beta features are not subject to the support SLA of official GA features.

## Logs

### Threat
Expand Down
15 changes: 12 additions & 3 deletions packages/ti_misp/manifest.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,15 +1,15 @@
name: ti_misp
title: MISP
version: "1.43.1"
version: "1.44.0"
description: Ingest threat intelligence indicators from MISP platform with Elastic Agent.
type: integration
format_version: "3.0.2"
format_version: "3.3.2"
categories:
- security
- threat_intel
conditions:
kibana:
version: "^8.13.0 || ^9.0.0"
version: "^8.19.4 || ~9.0.7 || ^9.1.4"
icons:
- src: /img/misp.svg
title: MISP
Expand All @@ -28,6 +28,15 @@ policy_templates:
- name: ti_misp
title: MISP
description: Ingest threat intelligence indicators from MISP platform with Elastic Agent.
deployment_modes:
default:
enabled: true
agentless:
enabled: true
release: beta
organization: security
division: engineering
team: security-service-integrations
inputs:
- type: httpjson
title: "Ingest threat intelligence indicators from MISP platform with Elastic Agent."
Expand Down
Loading