[Google TI] Promote Google Threat Intelligence integration from Tech Preview to GA

[jamiehynds]

Summary
The Google Threat Intelligence (GTI) integration has been in Tech Preview for over a year. With a blog post recently published to promote the integration and co-marketing with Google planned imminently, we need to complete the GA promotion as a priority.

Background

• Integration has been live in Tech Preview for 12+ months
• A blog post has been published promoting the integration
• Google co-marketing activities are upcoming — GA status is required to promote the integration externally

Scope / Clarifications

• The integration itself needs to reach GA
• The agentless delivery method can remain in beta — this is understood and acceptable

[infra-vault-gh-plugin-prod]

Pinging @elastic/security-service-integrations (Team:Security-Service Integrations)

[github-actions]

TL;DR: the most reliable path is to promote the package to GA by shipping 1.0.0 + a GA changelog entry, while deciding explicitly whether agentless should remain beta or be promoted separately (both patterns exist in this repo).

Recommendation

Promote ti_google_threat_intelligence to GA in the same way other integrations here do it: add a top changelog entry saying GA promotion and bump packages/ti_google_threat_intelligence/manifest.yml to version: "1.0.0".

For agentless, make an explicit product decision in this issue/PR:

1. Keep agentless.release: beta (valid precedent: GA package + beta agentless), or
2. Promote agentless.release to ga and remove the beta disclaimer in package docs.

Findings

• packages/ti_google_threat_intelligence/manifest.yml:6 → package is currently version: "0.11.0".
• packages/ti_google_threat_intelligence/manifest.yml:52 → deployment_modes.agentless.release: beta.
• packages/ti_google_threat_intelligence/changelog.yml:4-6 → latest entry explicitly established agentless as beta via PR Use agentless deployment 'release' field to agentless deployment modes #18552.
• packages/ti_google_threat_intelligence/docs/README.md:47 and packages/ti_google_threat_intelligence/_dev/build/docs/README.md:47 → agentless is documented as beta (with GA SLA exclusion).
• Precedent for GA agentless in same PR lineage:
  • packages/elastic_connectors/manifest.yml:43 + packages/elastic_connectors/changelog.yml:4 (release: ga, “establish as GA”, PR Use agentless deployment 'release' field to agentless deployment modes #18552)
  • packages/cloud_security_posture/manifest.yml:125 + packages/cloud_security_posture/changelog.yml:24 (release: ga, “establish as GA”, PR Use agentless deployment 'release' field to agentless deployment modes #18552)
• Precedent for GA package while agentless remains beta:
  • packages/aws_securityhub/changelog.yml:14 (“Promote integration to GA.”) and packages/aws_securityhub/manifest.yml:4 (1.x), but agentless.release: beta at manifest.yml:38
  • packages/ibm_qradar/changelog.yml:9 (“Promote integration to GA.”) and packages/ibm_qradar/manifest.yml:4 (1.x), but agentless.release: beta at manifest.yml:34
• TI-family GA versioning precedent:
  • packages/ti_opencti/changelog.yml:141-145 includes version: "1.0.0" + “Release package as GA.”

I attempted to pull related issues/PR discussions via GitHub MCP search/read, but issue/PR body access is partially integrity-filtered in this run, so I’m basing recommendations on verifiable in-repo evidence above.

Verification

$ grep -n "release: beta" packages/ti_google_threat_intelligence/manifest.yml
52:        release: beta

$ grep -n "This functionality is in beta" \
  packages/ti_google_threat_intelligence/docs/README.md \
  packages/ti_google_threat_intelligence/_dev/build/docs/README.md
packages/ti_google_threat_intelligence/docs/README.md:47:...This functionality is in beta...
packages/ti_google_threat_intelligence/_dev/build/docs/README.md:47:...This functionality is in beta...

$ grep -nE "establish as beta|pull/18552" packages/ti_google_threat_intelligence/changelog.yml
4:    - description: Use new `release` field for agentless deployment mode to establish as beta.
6:      link: https://github.com/elastic/integrations/pull/18552

$ grep -nE "release: ga|establish as GA" \
  packages/elastic_connectors/manifest.yml \
  packages/elastic_connectors/changelog.yml \
  packages/cloud_security_posture/manifest.yml \
  packages/cloud_security_posture/changelog.yml
packages/elastic_connectors/manifest.yml:43:        release: ga
packages/elastic_connectors/changelog.yml:4:    - description: ... establish as GA.
packages/cloud_security_posture/manifest.yml:125:        release: ga
packages/cloud_security_posture/changelog.yml:24:    - description: ... establish as GA.

Detailed Action Plan

1. Promote package to GA

   • Update packages/ti_google_threat_intelligence/manifest.yml:6 from 0.11.0 to 1.0.0.
   • Add top changelog entry in packages/ti_google_threat_intelligence/changelog.yml with description like “Promote integration to GA.” and link to the promotion PR.

2. Choose and apply agentless maturity stance

   • If keeping beta: leave packages/ti_google_threat_intelligence/manifest.yml:52 as beta and keep current docs wording.
   • If promoting agentless too: change manifest.yml:52 to release: ga and update both docs sources:
     • packages/ti_google_threat_intelligence/_dev/build/docs/README.md:47
     • packages/ti_google_threat_intelligence/docs/README.md:47

3. Run package checks before merge

   • Follow repo guidance in docs/extend/_publish_an_integration.md:11-25:
     • elastic-package check
     • elastic-package test
     • ensure changelog + version are consistent with release intent.

4. Document scope in PR description

   • Explicitly state whether GA covers package only or package+agentless, to avoid ambiguity with existing mixed precedents.

Related Items

Type	Link / File	Relevance
Issue	#19346	Current triage target
PR	#18552	Introduced release field usage and set GTI agentless to beta
PR	#8833	TI package (ti_opencti) GA promotion precedent
File	packages/ti_google_threat_intelligence/manifest.yml	Current package version + agentless release flag
File	packages/ti_google_threat_intelligence/changelog.yml	Latest maturity-related change
File	packages/ti_google_threat_intelligence/docs/README.md	User-facing beta statement
File	packages/ti_google_threat_intelligence/_dev/build/docs/README.md	Source docs beta statement
File	docs/extend/_publish_an_integration.md	Release process requirements (changelog/version/tests)

Note

🔒 Integrity filter blocked 36 items

The following items were blocked because they don't meet the GitHub integrity level.

• [Google TI] Promote Google Threat Intelligence integration from Tech Preview to GA #19346 issue_read: has lower integrity than agent requires. The agent cannot read data with integrity below "approved".
• #19346 issue_read: has lower integrity than agent requires. The agent cannot read data with integrity below "approved".
• #19346 search_issues: has lower integrity than agent requires. The agent cannot read data with integrity below "approved".
• #18788 search_issues: has lower integrity than agent requires. The agent cannot read data with integrity below "approved".
• #14287 search_issues: has lower integrity than agent requires. The agent cannot read data with integrity below "approved".
• #17766 search_issues: has lower integrity than agent requires. The agent cannot read data with integrity below "approved".
• #14286 search_issues: has lower integrity than agent requires. The agent cannot read data with integrity below "approved".
• #18996 search_issues: has lower integrity than agent requires. The agent cannot read data with integrity below "approved".
• #15147 search_issues: has lower integrity than agent requires. The agent cannot read data with integrity below "approved".
• #17360 search_issues: has lower integrity than agent requires. The agent cannot read data with integrity below "approved".
• #14186 search_issues: has lower integrity than agent requires. The agent cannot read data with integrity below "approved".
• #16335 search_issues: has lower integrity than agent requires. The agent cannot read data with integrity below "approved".
• #18403 search_issues: has lower integrity than agent requires. The agent cannot read data with integrity below "approved".
• #17361 search_issues: has lower integrity than agent requires. The agent cannot read data with integrity below "approved".
• #15168 search_issues: has lower integrity than agent requires. The agent cannot read data with integrity below "approved".
• #16937 search_issues: has lower integrity than agent requires. The agent cannot read data with integrity below "approved".
• ... and 20 more items

To allow these resources, lower min-integrity in your GitHub frontmatter:

tools:
  github:
    min-integrity: approved  # merged | approved | unapproved | none

---

What is this? | From workflow: Issue Triage

Give us feedback! React with 🚀 if perfect, 👍 if helpful, 👎 if not.

[kcreddy]

Related issue: #14287

[kcreddy]

As mentioned in #14287 (comment), the only pending blocker is #14286 which is previously partly addressed in #16175 and the remaining work is being addressed by @navnit-elastic in PR: #19383