From 626a365c4286b64dd1e4c652238a5e679f1784de Mon Sep 17 00:00:00 2001 From: Kyle Pollich Date: Thu, 20 Feb 2025 13:51:13 -0500 Subject: [PATCH] [Fleet] Add o365audit, gcp-pubsup, and azure-eventhub as disallowed agentles inputs (#211262) Closes https://github.com/elastic/kibana/issues/211092 ## Summary Disallows unsupported input types for security integrations adopting agentless. ### Checklist - [x] The PR description includes the appropriate Release Notes section, and the correct `release_note:*` label is applied per the [guidelines](https://www.elastic.co/guide/en/kibana/master/contributing.html#kibana-release-notes-process) cc @jamiehynds @qcorporation @kcreddy (cherry picked from commit 46812bc00a90f95385c7895cc10223ee789406ab) --- .../shared/fleet/common/constants/agentless.ts | 11 ++++++++++- 1 file changed, 10 insertions(+), 1 deletion(-) diff --git a/x-pack/platform/plugins/shared/fleet/common/constants/agentless.ts b/x-pack/platform/plugins/shared/fleet/common/constants/agentless.ts index 3b231762ec7d8..6476bd15e2691 100644 --- a/x-pack/platform/plugins/shared/fleet/common/constants/agentless.ts +++ b/x-pack/platform/plugins/shared/fleet/common/constants/agentless.ts @@ -19,4 +19,13 @@ export const AGENTLESS_GLOBAL_TAG_NAME_TEAM = 'team'; export const AGENTLESS_ALLOWED_OUTPUT_TYPES = [outputType.Elasticsearch]; // Input types to disable for agentless integrations -export const AGENTLESS_DISABLED_INPUTS = ['tcp', 'udp', 'filestream', 'http_endpoint', 'winlog']; +export const AGENTLESS_DISABLED_INPUTS = [ + 'tcp', + 'udp', + 'filestream', + 'http_endpoint', + 'winlog', + 'o365audit', + 'gcp-pubsub', + 'azure-eventhub', +];