Issues

• [Google Threat Intelligence] Discussion: replace the package's detection rules with Elastic's built-in Threat Intel Indicator Match rules

  Integration:ti_google_threat_intelligenceTeam:Security-Service Integrations
  elastic/integrations#22150 · Filter by author kcreddy opened on Oct 23, 2026
  1

• [Google Threat Intelligence] Document the overlap between package detection rules and Elastic's built-in Threat Intel Indicator Match rules

  documentationIntegration:ti_google_threat_intelligenceTeam:Security-Service Integrations
  elastic/integrations#22149 · Filter by author kcreddy opened on Oct 23, 2026
  1

• [Google Threat Intelligence] Align package detection rule mappings with Elastic's built-in Threat Intel Indicator Match rules

  enhancementIntegration:ti_google_threat_intelligenceTeam:Security-Service Integrations
  elastic/integrations#22148 · Filter by author kcreddy opened on Oct 23, 2026
  1

• Some ti_*: Source IOC data streams are matched by the built-in Threat Intel Indicator Match rules

  bugIntegration:ti_cyware_intel_exchangeIntegration:ti_flashpointIntegration:ti_google_threat_intelligenceIntegration:ti_greynoiseTeam:Security-Service Integrations
  elastic/integrations#22147 · Filter by author kcreddy opened on Oct 23, 2026
  1

• [proofpoint_on_demand] keep_alive_interval default of 30s equals the streaming input's read deadline; write_control_deadline not exposed

  Integration:proofpoint_on_demand
  elastic/integrations#22144 · Filter by author gbocchini opened on Oct 23, 2026

• [Custom Azure Logs] Promote the input package to GA

  Category: Integration qualityenhancementinputIntegration:azure_logs
  elastic/integrations#22138 · Filter by author zmoog opened on Oct 23, 2026

• [Stack 8.19.24-SNAPSHOT] [azure_network_watcher_vnet] Failing test daily: system test: default in azure_network_watcher_vnet.log

  automationflaky-testIntegration:azure_network_watcher_vnetTeam:Security-Service Integrations
  elastic/integrations#22135 · Filter by author elastic-vault-github-plugin-prod opened on Oct 23, 2026

• [Stack 8.19.24-SNAPSHOT] [azure_network_watcher_nsg] Failing test daily: system test: default in azure_network_watcher_nsg.log

  automationflaky-testIntegration:azure_network_watcher_nsgTeam:Security-Service Integrations
  elastic/integrations#22134 · Filter by author elastic-vault-github-plugin-prod opened on Oct 23, 2026

• [LogsDB] [Stack 8.19.24-SNAPSHOT] [azure_network_watcher_vnet] Failing test daily: system test: default in azure_network_watcher_vnet.log

  automationflaky-testIntegration:azure_network_watcher_vnetTeam:Security-Service Integrations
  elastic/integrations#22133 · Filter by author elastic-vault-github-plugin-prod opened on Oct 23, 2026

• [LogsDB] [Stack 8.19.24-SNAPSHOT] [azure_network_watcher_nsg] Failing test daily: system test: default in azure_network_watcher_nsg.log

  automationflaky-testIntegration:azure_network_watcher_nsgTeam:Security-Service Integrations
  elastic/integrations#22132 · Filter by author elastic-vault-github-plugin-prod opened on Oct 23, 2026

• [Threat Intel] Transform destination indices no longer map event.ingested statically; detection rules warn on empty indices

  bugTeam:Security-Service Integrations
  Bug

  elastic/integrations#22122 · Filter by author kcreddy opened on Oct 22, 2026
  1

  

• [Subscription basic] [kolide] Failing test daily: system test: default in kolide.deprovisioned_person

  automationflaky-testIntegration:kolideTeam:Security-Service Integrations
  elastic/integrations#22116 · Filter by author elastic-vault-github-plugin-prod opened on Oct 22, 2026

• [Serverless observability] [claude_code] Failing test daily: policy test: test-default.yml in claude_code.traces

  automationflaky-testIntegration:claude_codeTeam:Security-Service Integrations
  elastic/integrations#22115 · Filter by author elastic-vault-github-plugin-prod opened on Oct 22, 2026

• [Stack 8.19.24-SNAPSHOT] [couchbase] Failing test daily: system test: default (variant: v7.1.0) in couchbase.node

  automationflaky-testIntegration:couchbase
  elastic/integrations#22114 · Filter by author elastic-vault-github-plugin-prod opened on Oct 22, 2026

• [M365 Defender] Should the collector's cloud metadata end up in cloud.instance.id?

  Integration:m365_defender
  elastic/integrations#22105 · Filter by author tomsonpl opened on Oct 21, 2026
  1

• [cloudflare_logpush] Add the preserve_original_event option to the GCS input and link all data streams to the shared template

  enhancementIntegration:cloudflare_logpushTeam:SDE-CrestTeam:Security-Service Integrations
  elastic/integrations#22104 · Filter by author brijesh-elastic opened on Oct 21, 2026
  1

  

• [LogsDB] [Stack 8.19.24-SNAPSHOT] [network_traffic] Failing test daily: system test: http-post in network_traffic.http

  automationflaky-testIntegration:network_trafficTeam:Security-Service Integrations
  elastic/integrations#22096 · Filter by author elastic-vault-github-plugin-prod opened on Oct 21, 2026

• [Stack 8.19.24-SNAPSHOT] [network_traffic] Failing test daily: system test: sip-authenticated-register in network_traffic.sip

  automationflaky-testIntegration:network_trafficTeam:Security-Service Integrations
  elastic/integrations#22095 · Filter by author elastic-vault-github-plugin-prod opened on Oct 21, 2026

• [Stack 8.19.24-SNAPSHOT] [network_traffic] Failing test daily: system test: cassandra-create-keyspace in network_traffic.cassandra

  automationflaky-testIntegration:network_trafficTeam:Security-Service Integrations
  elastic/integrations#22094 · Filter by author elastic-vault-github-plugin-prod opened on Oct 21, 2026

• [Kubernetes] Support collecting container logs with a single filestream input with 9.6.0 agents

  Integration:kubernetesTeam:Elastic-Agent
  elastic/integrations#22087 · Filter by author cmacknz opened on Oct 20, 2026
  1

  

• [ti_custom]: TAXII pagination latches on next when the server reports more: false, halting all further polling

  Integration:ti_customneeds:triageTeam:Security-Service Integrations
  elastic/integrations#22084 · Filter by author gbocchini opened on Oct 20, 2026
  3

  

• [Fortinet FortiGate] event.outcome not populated for FortiAnalyzer-originated login events (subtype=fazsys)

  Integration:fortinet_fortigate
  elastic/integrations#22083 · Filter by author aditya-kaduskar opened on Oct 20, 2026

• [LogsDB] [Stack 8.19.24-SNAPSHOT] [apache_spark] Failing test daily: system test: (elastic-agent logs - metric (variant: v3.2.0)) in apache_spark.executor

  automationflaky-testIntegration:apache_sparkTeam:Obs-InfraObs
  elastic/integrations#22076 · Filter by author elastic-vault-github-plugin-prod opened on Oct 20, 2026

• [ESET PROTECT]: Add an incident data stream for ESET Connect /v2/incidents

  Integration:eset_protectneeds:triageTeam:SDE-CrestTeam:Security-Service Integrations
  elastic/integrations#22067 · Filter by author Terilia opened on Oct 19, 2026
  1

  

• [Google Threat Intel] Ingest Digital Threat Monitoring and General Alerts

  Integration:ti_google_threat_intelligenceTeam:SDE-CrestTeam:Security-Service Integrations
  elastic/integrations#22066 · Filter by author jamiehynds opened on Oct 19, 2026
  2