[Anomali] agentless deployment support

[sholzhauer-es]

Proposed commit message

Adding agentless support for Anomali integration

Checklist

• I have reviewed tips for building integrations and this pull request is aligned with them.
• I have verified that all data streams collect metrics or logs.
• I have added an entry to my package's changelog.yml file.
• I have verified that Kibana version constraints are current according to guidelines.
  - [ ] I have verified that any added dashboard complies with Kibana's [Dashboard good practices](https://docs.elastic.dev/ux-guidelines/data-viz/dashboard-good-practices)

Author's Checklist

• ensure kibana ui behaves properly

How to test this PR locally

Need credentials for anomali to test.

Related issues

• Closes #25213

Screenshots

[narph]

@sholzhauer-es , thanks for contributing to the integrations repo, we are slowly introducing integrations to agentless with phase 2 coming up next #14186. ti_anomali is not yet on the list as we need to do further testing and validate agentless is supported. cc @cpascale43

[elasticmachine]

Pinging @elastic/security-service-integrations (Team:Security-Service Integrations)

[botelastic]

Hi! We just realized that we haven't looked into this PR in a while. We're sorry! We're labeling this issue as Stale to make it hit our filters and make sure we get back to it as soon as possible. In the meantime, it'd be extremely helpful if you could take a look at it as well and confirm its relevance. A simple comment with a nice emoji will be enough :+1. Thank you for your contribution!

[mohitjha-elastic]

@sholzhauer-es From the Security Service team’s side, I have tested the ti_anomali agentless deployment support on ECH 8.18.0 and later versions, and it appears to be working as expected.
Testing on the Serverless environment and ECH 9.1.* has not yet been completed due to some issue.

Meanwhile, could you please look into resolving the build issue?

[sholzhauer-es]

@mohitjha-elastic perfect. I'll dive into the build failure and try and resolve it.

[elastic-vault-github-plugin-prod]

🚀 Benchmarks report

Package ti_anomali 👍(0) 💚(0) 💔(2)

Expand to view

Data stream	Previous EPS	New EPS	Diff (%)	Result
intelligence	9433.96	6134.97	-3298.99 (-34.97%)	💔
threatstream	8695.65	3861	-4834.65 (-55.6%)	💔

To see the full report comment with /test benchmark fullreport

[sholzhauer-es]

@mohitjha-elastic the build and merge conflicts have been resolved.

[mohitjha-elastic]

@elastic/security-service-integrations Could someone from the team please review the PR?

[elastic-sonarqube]

Quality Gate passed

Issues
0 New issues
0 Fixed issues
0 Accepted issues

Measures
0 Security Hotspots
100.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube

[efd6]

LGTM, but please wait for @alaudazzi for review of the doc change.

[sholzhauer-es]

@alaudazzi have you had a chance to look at this?

[botelastic]

Hi! We just realized that we haven't looked into this PR in a while. We're sorry! We're labeling this issue as Stale to make it hit our filters and make sure we get back to it as soon as possible. In the meantime, it'd be extremely helpful if you could take a look at it as well and confirm its relevance. A simple comment with a nice emoji will be enough :+1. Thank you for your contribution!

[botelastic]

Hi! We just realized that we haven't looked into this PR in a while. We're sorry! We're labeling this issue as Stale to make it hit our filters and make sure we get back to it as soon as possible. In the meantime, it'd be extremely helpful if you could take a look at it as well and confirm its relevance. A simple comment with a nice emoji will be enough :+1. Thank you for your contribution!

[alaudazzi]

LGTM

[mohitjha-elastic]

@sholzhauer-es Can you please resolve the conflicts to proceed with this PR?

[sholzhauer-es]

@mohitjha-elastic and @elastic/security-service-integrations I fixed the conflict.

[elasticmachine]

💚 Build Succeeded

• Buildkite Build
• Commit: 244d42b

History

• 💚 Build #34420 succeeded 7c1d246
• 💚 Build #30284 succeeded bcc8563
• 💚 Build #30196 succeeded 7fd1089
• 💔 Build #30191 failed 8c89259
• 💔 Build #30183 failed 7faf81d
• 💔 Build #28576 failed 16f5389

[sholzhauer-es]

@mohitjha-elastic Am i good to merge?

[mohitjha-elastic]

@sholzhauer-es I merged the PR. Thanks!

[elastic-vault-github-plugin-prod]

Package ti_anomali - 2.2.0 containing this change is available at https://epr.elastic.co/package/ti_anomali/2.2.0/