[DGA] Add serverless security capability to DGA

[sodhikirti07]

Proposed commit message

This PR adds security serverless capability to DGA manifest.

Checklist

• I have reviewed tips for building integrations and this pull request is aligned with them.
• I have verified that all data streams collect metrics or logs.
• I have added an entry to my package's changelog.yml file.
• I have verified that Kibana version constraints are current according to guidelines.
• I have verified that any added dashboard complies with Kibana's Dashboard good practices

Author's Checklist

• [ ]

How to test this PR locally

Related issues

Screenshots

[github-actions]

✅ Elastic Docs Style Checker (Vale)

No issues found on modified lines!

---

The Vale linter checks documentation changes against the Elastic Docs style guide. To use Vale locally or report issues, refer to Elastic style guide for Vale.

[sodhikirti07]

Previously, an issue with the DGA integration prevented us from promoting it to Serverless during the initial launch. The issue was related to the ingest node sizing requirements for large models like DGA. This has now been resolved by the ML team under: elastic/elasticsearch#152981 and https://github.com/elastic/elasticsearch-serverless/pull/7182.

I tested installing the DGA integration on the latest serverless (search project) deployment and was able to get the prediction from the model. Couldn't test it on security project as DGA is in security serverless exclusion list. Once the PR to remove DGA from exclusion list is merged, I'll test this PR again in security project.

[sodhikirti07]

Tested DGA on QA serverless and I was able to install and run the model:

[infra-vault-gh-plugin-prod]

Pinging @elastic/sec-applied-ml (Team:Security-Applied ML)

[github-actions]

TL;DR

The Buildkite failure is a configuration/versioning mismatch in the DGA package metadata. changelog.yml was advanced to 3.3.0, but manifest.yml is still 3.2.0, so package lint fails.

Remediation

• Bump packages/dga/manifest.yml version from 3.2.0 to 3.3.0 so it matches the new top changelog entry.
• Re-run the same CI step (Check integrations dga) after that version alignment.

Investigation details

Root Cause

The package lint step enforces consistency between the current package version and changelog entries. In this PR commit:

• packages/dga/manifest.yml:4 has version: 3.2.0
• packages/dga/changelog.yml:2 introduces - version: "3.3.0"

That mismatch causes lint to fail with a changelog/version validation error.

Evidence

• Build: https://buildkite.com/elastic/integrations/builds/47722
• Job/step: Check integrations dga
• Key log excerpt:

Error: checking package failed: linting package failed: found 1 validation error:
   1. current manifest version doesn't have changelog entry

Verification

• Not run locally in this workflow environment; conclusion is based on Buildkite logs plus PR commit file contents at 1105d5d0c10d2a7190e0b624fc6d1ea638c1a148.

Follow-up

If you intentionally do not want a version bump in this PR, remove the 3.3.0 changelog entry and keep changelog aligned to 3.2.0.

---

What is this? | From workflow: PR Buildkite Detective

Give us feedback! React with 🚀 if perfect, 👍 if helpful, 👎 if not.

[elastic-vault-github-plugin-prod]

✅ All changelog entries have the correct PR link.

[infra-vault-gh-plugin-prod]

💚 Build Succeeded

• Buildkite Build
• Commit: fe66e77

History

• 💔 Build #47722 failed 1105d5d
• 💚 Build #47650 succeeded cfdf4f6
• 💚 Build #47644 succeeded 5679dfb
• 💚 Build #47165 succeeded 640277b
• 💔 Build #47163 failed 40111a9

[mergify]

Queued — the merge queue status continues in this comment ↓.

[elastic-vault-github-plugin-prod]

Security-ML Integrations Test Pipeline — Integrations CI (run #2)

🟢 All packages passed

Package	Stack version	Result
dga	9.5.1	🟢

[mergify]

Merge Queue Status

• 🟠 Waiting for queue conditions
• ⏳ Enter queue
• ⏳ Run checks
• ⏳ Merge

Required conditions to enter a queue

• -closed [📌 queue requirement]
• -conflict [📌 queue requirement]
• -draft [📌 queue requirement]
• any of [📌 queue -> configuration change requirements]:
  • -mergify-configuration-changed
  • check-success = Configuration changed
• any of [🔀 queue conditions]:
  • all of [📌 queue conditions of queue rule default]:
    • github-review-approved [🛡 GitHub branch protection]
    • github-review-approved [🛡 GitHub repository ruleset rule [org] Require a PR for Renovate]
    • github-review-approved [🛡 GitHub repository ruleset rule [org] Require a PR]
    • any of [🛡 GitHub branch protection]:
      • check-success = CLA
      • check-neutral = CLA
      • check-skipped = CLA
    • any of [🛡 GitHub branch protection]:
      • check-success = buildkite/integrations
      • check-neutral = buildkite/integrations
      • check-skipped = buildkite/integrations

[mergify]

queue

☑️ The pull request has been merged manually

Details

The pull request has been merged manually at 377f3fc

[elastic-vault-github-plugin-prod]

Package dga - 3.3.0 containing this change is available at https://epr.elastic.co/package/dga/3.3.0/