Skip to content

Enable zscaler and sentinel one for agentless - #13107

Merged
qcorporation merged 2 commits into
mainfrom
11810-zscaler
Mar 13, 2025
Merged

Enable zscaler and sentinel one for agentless#13107
qcorporation merged 2 commits into
mainfrom
11810-zscaler

Conversation

@qcorporation

Copy link
Copy Markdown
Contributor

Parent Ticket:
#11810

Proposed commit message

  • Updated the documentation based upon agreed upon language to highlight that the integration now supports Agentless deployment for both sentinel one and zscaler
  • Upgraded the format_version to latest, 3.2.3
  • Updated Kibana version constraints to ^8.18 || ^9.0.0
    Screenshot 2025-03-13 at 11 45 42 AM
    Screenshot 2025-03-13 at 11 47 29 AM

Checklist

  • I have reviewed tips for building integrations and this pull request is aligned with them.
  • I have verified that all data streams collect metrics or logs.
  • I have added an entry to my package's changelog.yml file.
  • I have verified that Kibana version constraints are current according to guidelines.
  • I have verified that any added dashboard complies with Kibana's Dashboard good practices

How to test this PR locally (Note: only tested Sentinel One, enabled zscaler)

  1. Setup an api token within Sentinel One
  2. Fill in the Console URL and API token within the Sentinel One configuration
  3. Validated that data gets ingested into ES
  4. Validated that the agentless index gets created and populated with the right values
  5. Validate that the agent logs do not show any errors after a period of time in operation

Note: I set the start interval was 165d to get as much initial data as possible

@qcorporation qcorporation added Integration:zscaler_zia Zscaler Internet Access Team:Service-Integrations Label for the Observability Service Integrations team Integration:sentinel_one SentinelOne labels Mar 13, 2025
@qcorporation
qcorporation requested a review from a team March 13, 2025 15:55
@qcorporation qcorporation self-assigned this Mar 13, 2025
@elasticmachine

Copy link
Copy Markdown

💚 Build Succeeded

cc @qcorporation

@qcorporation
qcorporation marked this pull request as ready for review March 13, 2025 16:28
@qcorporation
qcorporation merged commit 9e075e3 into main Mar 13, 2025
@qcorporation
qcorporation deleted the 11810-zscaler branch March 13, 2025 18:32
@elastic-vault-github-plugin-prod

Copy link
Copy Markdown
Contributor

Package sentinel_one - 1.30.0 containing this change is available at https://epr.elastic.co/package/sentinel_one/1.30.0/

@elastic-vault-github-plugin-prod

Copy link
Copy Markdown
Contributor

Package zscaler_zia - 3.8.0 containing this change is available at https://epr.elastic.co/package/zscaler_zia/3.8.0/

flexitrev pushed a commit that referenced this pull request Mar 20, 2025
* Enable zscaler and sentinel one for agentless
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

Integration:sentinel_one SentinelOne Integration:zscaler_zia Zscaler Internet Access Team:Service-Integrations Label for the Observability Service Integrations team

3 participants