entity_analytics*: add agentless deployment mode and use_minimal_state config

[efd6]

Add agentless deployment mode support and the use_minimal_state configuration variable to the three entity analytics integration packages:

• entityanalytics_okta
• entityanalytics_entra_id
• entityanalytics_ad

For each package:

1. Add use_minimal_state variable to data_stream/entity/manifest.yml (bool, default true, hidden from both deployment modes — implementation detail, not user-facing).
2. Wire into the Handlebars config template (entity-analytics.yml.hbs).
3. Add deployment_modes block to the policy template in manifest.yml (default + agentless with release: beta).
4. Review provider-specific fields for hide_in_deployment_modes where they are irrelevant or confusing in agentless mode.

Depends on:

• x-pack/filebeat/input/entityanalytics: integration testing and agentless coordination beats#50774 (ES state store adapter)
• elastic/agentless-controller env var update

The integration package change must not land before the agentless-controller change so that agentless deployments never run minimal state without ES-backed storage available.

Related: elastic/beats#50774
Depends: 9.5+

[infra-vault-gh-plugin-prod]

Pinging @elastic/security-service-integrations (Team:Security-Service Integrations)

[github-actions]

tl;dr: Don’t add agentless deployment mode to entityanalytics_* yet without first bumping package format_version to at least 3.3.2; then add explicit use_minimal_state vars/templates and policy rendering tests across all three packages.

Recommendation

Proceed in two phases:

1. Compatibility phase: bump format_version for entityanalytics_ad, entityanalytics_entra_id, and entityanalytics_okta before introducing deployment_modes.
2. Feature phase: add deployment_modes.agentless + explicit use_minimal_state config (not custom_options-only) and add/extend policy tests.

This is the safest path because current format versions remove deployment_modes from schema validation for older package formats.

Findings

1. All three target packages are still on format_version: "3.0.2":

   • packages/entityanalytics_ad/manifest.yml:1
   • packages/entityanalytics_entra_id/manifest.yml:1
   • packages/entityanalytics_okta/manifest.yml:1

2. deployment_modes is currently absent in all three target manifests (no deployment_modes: key under policy_templates).

3. Spec compatibility constraint: deployment_modes is removed before 3.1.4 in manifest spec patches:

   • docs/extend/manifest-spec.md:661-664
   • Additional agentless/default field constraints for older versions: docs/extend/manifest-spec.md:645-652, 657-660

4. Repo precedent for agentless structure (same team/org metadata style):

   • packages/okta/manifest.yml:25-34
   • packages/jumpcloud/manifest.yml:29-37

5. use_minimal_state is not present today in any of the three entityanalytics packages (no matches in package trees).

6. Only Entra currently has a generic passthrough (custom_options):

   • var declaration: packages/entityanalytics_entra_id/data_stream/entity/manifest.yml:138-147
   • raw template injection: packages/entityanalytics_entra_id/data_stream/entity/agent/stream/entity-analytics.yml.hbs:19-21
   • rendered in policy golden test:
     • input fixture: .../test-intune-with-custom-options.yml:7-13
     • expected output: .../test-intune-with-custom-options.expected:40-44
   • AD/Okta templates have no equivalent passthrough hook:
     • packages/entityanalytics_ad/data_stream/entity/agent/stream/entity-analytics.yml.hbs:1-22
     • packages/entityanalytics_okta/data_stream/entity/agent/stream/entity-analytics.yml.hbs:1-26

Verification

I checked format/deployment-state directly in the workspace:

$ grep -n 'format_version: "3.0.2"' packages/entityanalytics_ad/manifest.yml packages/entityanalytics_entra_id/manifest.yml packages/entityanalytics_okta/manifest.yml
packages/entityanalytics_ad/manifest.yml:1:format_version: "3.0.2"
packages/entityanalytics_entra_id/manifest.yml:1:format_version: "3.0.2"
packages/entityanalytics_okta/manifest.yml:1:format_version: "3.0.2"

$ grep -n 'deployment_modes:' packages/entityanalytics_ad/manifest.yml packages/entityanalytics_entra_id/manifest.yml packages/entityanalytics_okta/manifest.yml
# (no output)

$ grep -n 'deployment_modes:\|agentless:\|organization:\|team:' packages/okta/manifest.yml packages/jumpcloud/manifest.yml
packages/okta/manifest.yml:25:    deployment_modes:
packages/okta/manifest.yml:28:      agentless:
packages/okta/manifest.yml:32:        organization: security
packages/okta/manifest.yml:34:        team: security-service-integrations
packages/jumpcloud/manifest.yml:29:    deployment_modes:
packages/jumpcloud/manifest.yml:32:      agentless:
packages/jumpcloud/manifest.yml:35:        organization: security
packages/jumpcloud/manifest.yml:37:        team: security-service-integrations

$ grep -R -n 'use_minimal_state' packages/entityanalytics_ad packages/entityanalytics_entra_id packages/entityanalytics_okta
# (no output)

Detailed Action Plan

1. Bump package format first in:

   • packages/entityanalytics_ad/manifest.yml:1
   • packages/entityanalytics_entra_id/manifest.yml:1
   • packages/entityanalytics_okta/manifest.yml:1

   Use a format that supports the needed deployment_modes shape (>= 3.3.2 if using agentless is_default semantics, per spec patches in docs/extend/manifest-spec.md:645-664).

2. Add agentless deployment mode under each package’s policy_templates[0] (near current policy_templates blocks):

   • packages/entityanalytics_ad/manifest.yml:20-27
   • packages/entityanalytics_entra_id/manifest.yml:21-28
   • packages/entityanalytics_okta/manifest.yml:29-36

   Mirror existing security-service-integrations precedent from:

   • packages/okta/manifest.yml:25-34
   • packages/jumpcloud/manifest.yml:29-37

3. Add explicit use_minimal_state stream var in all three stream manifests near interval/config vars:

   • packages/entityanalytics_ad/data_stream/entity/manifest.yml
   • packages/entityanalytics_entra_id/data_stream/entity/manifest.yml
   • packages/entityanalytics_okta/data_stream/entity/manifest.yml

4. Render use_minimal_state in each stream template near sync_interval/update_interval:

   • packages/entityanalytics_ad/data_stream/entity/agent/stream/entity-analytics.yml.hbs
   • packages/entityanalytics_entra_id/data_stream/entity/agent/stream/entity-analytics.yml.hbs
   • packages/entityanalytics_okta/data_stream/entity/agent/stream/entity-analytics.yml.hbs

5. Test coverage:

   • Extend Entra policy golden tests to include explicit use_minimal_state rendering.
   • Add policy rendering tests for AD/Okta (they currently rely on pipeline/system tests) to lock this key in generated policy.

6. Version/changelog updates:

   • Bump package versions and add changelog entries in each package (changelog.yml) documenting:
     • agentless deployment mode support
     • new use_minimal_state option

Related Items

Type	Link / Path	Relevance
Issue	#19499	Request being triaged
File	docs/extend/manifest-spec.md:645-664	Format/version gating for deployment_modes
File	packages/okta/manifest.yml:25-34	Canonical same-team deployment_modes.agentless example
File	packages/jumpcloud/manifest.yml:29-37	Secondary same-team agentless example
File	packages/entityanalytics_entra_id/data_stream/entity/manifest.yml:138-147	Existing custom_options passthrough
File	packages/entityanalytics_entra_id/data_stream/entity/agent/stream/entity-analytics.yml.hbs:19-21	Raw passthrough injection point
Related issues search	attempted via MCP (entity_analytics)	Results were integrity-filtered in this run, so duplicate assessment is limited

Note

🔒 Integrity filter blocked 24 items

The following items were blocked because they don't meet the GitHub integrity level.

• #19499 search_issues: has lower integrity than agent requires. The agent cannot read data with integrity below "approved".
• #19499 issue_read: has lower integrity than agent requires. The agent cannot read data with integrity below "approved".
• #7009 search_issues: has lower integrity than agent requires. The agent cannot read data with integrity below "approved".
• #8559 search_issues: has lower integrity than agent requires. The agent cannot read data with integrity below "approved".
• #19470 search_pull_requests: has lower integrity than agent requires. The agent cannot read data with integrity below "approved".
• #19339 search_pull_requests: has lower integrity than agent requires. The agent cannot read data with integrity below "approved".
• #19266 search_pull_requests: has lower integrity than agent requires. The agent cannot read data with integrity below "approved".
• #19191 search_pull_requests: has lower integrity than agent requires. The agent cannot read data with integrity below "approved".
• #19036 search_pull_requests: has lower integrity than agent requires. The agent cannot read data with integrity below "approved".
• #19090 search_pull_requests: has lower integrity than agent requires. The agent cannot read data with integrity below "approved".
• #19037 search_pull_requests: has lower integrity than agent requires. The agent cannot read data with integrity below "approved".
• #19219 search_pull_requests: has lower integrity than agent requires. The agent cannot read data with integrity below "approved".
• #19062 search_pull_requests: has lower integrity than agent requires. The agent cannot read data with integrity below "approved".
• #19185 search_pull_requests: has lower integrity than agent requires. The agent cannot read data with integrity below "approved".
• #18345 search_pull_requests: has lower integrity than agent requires. The agent cannot read data with integrity below "approved".
• #19439 search_pull_requests: has lower integrity than agent requires. The agent cannot read data with integrity below "approved".
• ... and 8 more items

To allow these resources, lower min-integrity in your GitHub frontmatter:

tools:
  github:
    min-integrity: approved  # merged | approved | unapproved | none

---

What is this? | From workflow: Issue Triage

Give us feedback! React with 🚀 if perfect, 👍 if helpful, 👎 if not.