[trellix_epo_cloud, withsecure_elements] Add Agentless Deployment

[mohitjha-elastic]

Proposed commit message

trellix_epo_cloud, withsecure_elements: add agentless deployment

This update introduces agentless deployment support for trellix_epo_cloud and
withsecure_elements. Additionally, a README.md file has been added under _dev/build/docs
for withsecure_elements to support proper rendering of README documentation.

Checklist

• I have reviewed tips for building integrations and this pull request is aligned with them.
• I have verified that all data streams collect metrics or logs.
• I have added an entry to my package's changelog.yml file.
• I have verified that Kibana version constraints are current according to guidelines.
• I have verified that any added dashboard complies with Kibana's Dashboard good practices

How to test this PR locally

• Clone integrations repo.
• Install the elastic package locally.
• Start the elastic stack using the elastic package.
• Move to integrations/packages/ {integration} directory.
• Run the following command to run tests.

elastic-package test -v

Related issues

• Closes [trellix_epo_cloud] Add Agentless Deployment Support #19600
• Closes [withsecure_elements] Add Agentless Deployment Support #19682

[infra-vault-gh-plugin-prod]

Pinging @elastic/security-service-integrations (Team:Security-Service Integrations)

[github-actions]

Elastic Docs Style Checker (Vale)

Summary: 3 warnings, 2 suggestions found

⚠️ Warnings (3): Fix when the suggestion improves clarity or correctness.

File	Line	Rule	Message
packages/withsecure_elements/_dev/build/docs/README.md	61	Elastic.Latinisms	Latin terms and abbreviations are a common source of confusion. Use 'and so on' instead of 'etc'.
packages/withsecure_elements/_dev/build/docs/README.md	63	Elastic.Latinisms	Latin terms and abbreviations are a common source of confusion. Use 'and so on' instead of 'etc'.
packages/withsecure_elements/_dev/build/docs/README.md	93	Elastic.DontUse	Don't use 'please'.

💡 Suggestions (2): Optional style improvements. Apply when helpful.

File	Line	Rule	Message
packages/withsecure_elements/_dev/build/docs/README.md	29	Elastic.WordChoice	Consider using 'deactivate, deselect, hide, turn off' instead of 'disable', unless the term is in the UI.
packages/withsecure_elements/_dev/build/docs/README.md	44	Elastic.WordChoice	Consider using 'deactivated, deselected, hidden, turned off, unavailable' instead of 'Disabled', unless the term is in the UI.

---

The Vale linter checks documentation changes against the Elastic Docs style guide. To use Vale locally or report issues, refer to Elastic style guide for Vale.

[elastic-vault-github-plugin-prod]

✅ All changelog entries have the correct PR link.

[elastic-vault-github-plugin-prod]

🚀 Benchmarks report

To see the full report comment with /test benchmark fullreport

[infra-vault-gh-plugin-prod]

💚 Build Succeeded

• Buildkite Build
• Commit: da9af52

cc @mohitjha-elastic

[vera-review-bot]

👀 I have started reviewing the PR

[vera-review-bot]

🟡 MEDIUM data_stream/event/.../default.yml:21

Agentless metadata fields not removed in CEL pipelines

This PR enables Agentless deployment for the package (manifest deployment_modes.agentless.enabled: true). When the Agentless framework runs the CEL input, it injects the metadata fields organization, division, and team into the document root. The three trellix_epo_cloud pipelines (this event pipeline plus device/.../default.yml and group/.../default.yml) do not strip them. organization is defined in ECS as an object (organization.name, organization.id); an injected top-level string value (here organization: security) collides with that mapping and can cause indexing/mapping conflicts, and division/team get indexed as stray non-ECS fields. The CEL/Agentless opening remove (and the error-placeholder terminate) processors documented for CEL inputs are absent here, so enabling Agentless surfaces this gap now rather than hypothetically.

Recommendation:

Add the CEL/Agentless opening processors near the top of each of the three pipelines (event, device, group), before the rename message -> event.original step:

  - remove:
      field:
        - organization
        - division
        - team
      ignore_missing: true
      if: ctx.organization instanceof String && ctx.division instanceof String && ctx.team instanceof String
      tag: remove_agentless_tags
      description: >-
        Removes the fields added by Agentless as metadata,
        as they can collide with ECS fields.
  - terminate:
      tag: data_collection_error
      if: ctx.error?.message != null && ctx.message == null && ctx.event?.original == null
      description: error message set and no data to process.

---

🤖 AI-Generated Review | Vera Review Bot | 📚 Knowledge base: integration-skills

⚠️ Automated review — verify suggestions before applying.

[mohitjha-elastic]

This is not required in kibana version 8.19.2 and above. Ref - elastic/kibana#221312

[kcreddy]

Replace _dev/deploy/doc with _dev/build/docs in the commit message.

LGTM otherwise.

[mergify]

Tick the box to add this pull request to the merge queue (same as @mergifyio queue).

• Queue this pull request

[elastic-vault-github-plugin-prod]

Package trellix_epo_cloud - 1.16.0 containing this change is available at https://epr.elastic.co/package/trellix_epo_cloud/1.16.0/

[elastic-vault-github-plugin-prod]

Package withsecure_elements - 0.3.0 containing this change is available at https://epr.elastic.co/package/withsecure_elements/0.3.0/