[Fleet] Restrict Azure Eventhub input for agentless integrations

[kcreddy]

Coming from elastic/integrations#12586 (comment), while testing Microsoft Sentinel integration in 8.18.0 cloud environment (also Serverless), the integration policy UI shows 2 inputs: API and Azure EventHub.

azure-eventhub input is unsupported in Agentless at the moment as per elastic/integrations#12586 (comment) and needs to be removed just like other inputs here: #202091.

Screenshot from 8.18.0 cloud environment

Edit: As per #211092 (comment), we also need to block o365audit and gcp-pubsub along with azure-eventhub

cc: @qcorporation @jamiehynds

[elasticmachine]

Pinging @elastic/fleet (Team:Fleet)

[qcorporation]

We will need to block o365audit, azure-eventhub, gcp-pubsub

[jamiehynds]

@nimarezainia @kpollich is this something y'all could address sooner rather than later? We have a number of integrations that we'd like to add agentless support to. They support ingest via API and other inputs yet so be supported by agentless. We'd ideally like to address this issue before making these integrations agentless, as it'll likely cause confusion. If there's an ETA we can plan around it. Thanks!

[kpollich]

Yes we can take care of this ASAP.

Does it make more sense to move to an allowlist rather than a blocklist for these input types? Should we simply only allow httpjson and cel inputs for now?

[kpollich]

cc @jen-huang @criamico

[kpollich]

#211262

[jamiehynds]

Yes we can take care of this ASAP.

Does it make more sense to move to an allowlist rather than a blocklist for these input types? Should we simply only allow httpjson and cel inputs for now?

No objections on my end, and we can add more inputs to the allowlist once we support S3 etc. Thanks for jumping on it so quickly!

[kpollich]

I added #211275 as a chore to our next sprint to swap this to an allowlist.