[ti_eset] Update documentation with new data streams

[polakovicp]

[ti_eset] Update documentation with new data streams

PR updates integration version and documentations for new data streams added in following PRs:

• [ti_eset] Add emailattachments data stream #19138
• [ti_eset] Add androidinfostealer data stream #19136
• [ti_eset] Add androidthreats data stream #19135
• [ti_eset] Add cryptoscam data stream #19134
• [ti_eset] Add phishingurl data stream #19133
• [ti_eset] Add puaadware data stream #19132
• [ti_eset] Add puadualapps data stream #19131
• [ti_eset] Add ransomware data stream #19130
• [ti_eset] Add scamurl data stream #19129
• [ti_eset] Add smishing data stream #19128
• [ti_eset] Add smsscam data stream #19127
• [ti_eset] Fix grok processor not consuming spaces in IoC pattern #19126
• [ti_eset] Use cel templates for existing data streams #19125

Related issues

Relates to PR #18709

[elastic-vault-github-plugin-prod]

Reviewers

Buildkite won't run for external contributors automatically; you need to add a comment:

• /test : will kick off a build in Buildkite.

NOTE: https://github.com/elastic/integrations/blob/main/.buildkite/pull-requests.json contains all those details.

[polakovicp]

Please change target to ti_set_polakovicp_enhancements

[infra-vault-gh-plugin-prod]

Pinging @elastic/security-service-integrations (Team:Security-Service Integrations)

[DavidRohlik]

@efd6 @andrewkroh Please what's the status of the rest of our PRs here? Right now only one is approved and merged, but it contains only our old data streams but not the new ones

[vera-review-bot]

This PR has merge conflicts with the base branch. Please resolve them before it can be reviewed or approved.

[vera-review-bot]

👀 I have started reviewing the PR

[vera-review-bot]

🔴 CRITICAL _dev/build/docs/README.md:105

Docs template references data streams that do not exist

The README template adds {{fields "..."}} / {{event "..."}} sections for ten feeds that have no data stream in this PR: androidthreats, cryptoscam, emailattachments, phishingurl, puaadware, puadualapps, ransomware, scamurl, smishing, smsscam. The only new data stream directory added by this PR is data_stream/androidinfostealer/; the package contains exactly 8 data streams (androidinfostealer, apt, botnet, cc, domains, files, ip, url). The {{fields "androidthreats"}} helper resolves against data_stream/androidthreats/fields/, which is absent, so elastic-package build/check (run in CI to verify generated docs are current) fails to render the template. The committed rendered docs/README.md is therefore inconsistent with the package contents and cannot be regenerated.

Recommendation:

Either include the missing data stream directories in this PR, or limit the documentation template to feeds that actually ship. Only reference data streams that exist:

### Android info stealer

{{fields "androidinfostealer"}}

{{event "androidinfostealer"}}

### APT

{{fields "apt"}}

{{event "apt"}}

Remove the ### Android Threats, ### Crypto scam, ### Email attachments, ### Phishing URL, ### PUA adware, ### PUA dual apps, ### Ransomware, ### Scam URL, ### SMS phishing, and ### SMS scam sections (and the corresponding rows in the Dataset / Destination / ILM tables) until their data streams are added.

---

🤖 AI-Generated Review | Vera Review Bot | 📚 Knowledge base: integration-skills

⚠️ Automated review — verify suggestions before applying.

[vera-review-bot]

🟡 MEDIUM _dev/build/docs/README.md:183

Scam URL section renders the ip feed's fields and example

Under the ### Scam URL heading the template uses {{fields "ip"}} and {{event "ip"}} instead of the scamurl feed. This is a copy-paste error: the Scam URL section would document the IP feed's exported fields and example event rather than scamurl's, misleading users about what the scamurl data stream produces.

Recommendation:

Reference the scamurl feed in its own section:

### Scam URL

{{fields "scamurl"}}

{{event "scamurl"}}

---

🤖 AI-Generated Review | Vera Review Bot | 📚 Knowledge base: integration-skills

⚠️ Automated review — verify suggestions before applying.

[vera-review-bot]

🟠 HIGH data_stream/androidinfostealer/manifest.yml:5

New cel data stream has no cel input in any policy template

This data stream declares input: cel and its cel.yml.hbs references {{username}} and {{password}}. However, the root manifest's only policy template (eset) declares a single httpjson input, and username/password are defined as vars of that httpjson input. No cel input is declared in any policy template, and the cel data stream does not define username/password in its own vars. Because policy-template input vars are scoped to streams of that same input type, the cel stream cannot obtain credentials and is not surfaced by the httpjson-only policy template when deployed via Fleet. The existing 7 data streams work because they use httpjson, matching the policy template; this new cel stream breaks that wiring and will authenticate with empty credentials.

Recommendation:

Add a cel input to the eset policy template alongside the existing httpjson input, exposing the shared credential vars, so the cel data stream can be configured and authenticated:

policy_templates:
  - name: eset
    title: ETI feeds (TAXII version 2)
    description: Collect data from ETI feeds (TAXII version 2)
    inputs:
      - type: httpjson
        title: ETI feeds (TAXII version 2)
        description: Collect data from ETI feeds (TAXII version 2)
        vars:
          - name: username
            type: text
            title: ETI Username
            required: true
            show_user: true
          - name: password
            type: password
            title: ETI Password
            required: true
            secret: true
            show_user: true
      - type: cel
        title: ETI feeds (TAXII version 2 - CEL)
        description: Collect data from ETI feeds (TAXII version 2)
        vars:
          - name: username
            type: text
            title: ETI Username
            required: true
            show_user: true
          - name: password
            type: password
            title: ETI Password
            required: true
            secret: true
            show_user: true

---

🤖 AI-Generated Review | Vera Review Bot | 📚 Knowledge base: integration-skills

⚠️ Automated review — verify suggestions before applying.

[botelastic]

Hi! We just realized that we haven't looked into this PR in a while. We're sorry! We're labeling this issue as Stale to make it hit our filters and make sure we get back to it as soon as possible. In the meantime, it'd be extremely helpful if you could take a look at it as well and confirm its relevance. A simple comment with a nice emoji will be enough :+1. Thank you for your contribution!

[botelastic]

Hi! This PR has been stale for a while and we're going to close it as part of our cleanup procedure. We appreciate your contribution and would like to apologize if we have not been able to review it, due to the current heavy load of the team. Feel free to re-open this PR if you think it should stay open and is worth rebasing. Thank you for your contribution!