Skip to content

ti_custom: allow max_executions to be configured for indicator data stream#18330

Open
kcreddy wants to merge 2 commits intoelastic:mainfrom
kcreddy:ti_custom-max_executions
Open

ti_custom: allow max_executions to be configured for indicator data stream#18330
kcreddy wants to merge 2 commits intoelastic:mainfrom
kcreddy:ti_custom-max_executions

Conversation

@kcreddy
Copy link
Copy Markdown
Contributor

@kcreddy kcreddy commented Apr 10, 2026

Proposed commit message

ti_custom: allow max_executions to be configured for indicator data stream

Large TAXII 2.1 feeds can exceed the default CEL execution limit of
1000 iterations per polling cycle, causing the input to go DEGRADED.
Expose max_executions as an optional advanced parameter so users can
raise the cap for high-volume feeds.

Checklist

  • I have reviewed tips for building integrations and this pull request is aligned with them.
  • I have verified that all data streams collect metrics or logs.
  • I have added an entry to my package's changelog.yml file.
  • I have verified that Kibana version constraints are current according to guidelines.
  • I have verified that any added dashboard complies with Kibana's Dashboard good practices

Related issues

kcreddy added 2 commits April 10, 2026 17:17
@kcreddy
ti_custom: allow max_executions to be configured for indicator data s…
7ba14c5 
…tream

Large TAXII 2.1 feeds can exceed the default CEL execution limit of
1000 iterations per polling cycle, causing the input to go DEGRADED.
Expose max_executions as an optional advanced parameter so users can
raise the cap for high-volume feeds.
@kcreddy
update PR number
493666f
@kcreddy kcreddy self-assigned this Apr 10, 2026
@kcreddy kcreddy added enhancement New feature or request Team:Security-Service Integrations Security Service Integrations team [elastic/security-service-integrations] Integration:ti_custom Custom Threat Intelligence labels Apr 10, 2026
@kcreddy kcreddy marked this pull request as ready for review April 10, 2026 11:49
@kcreddy kcreddy requested a review from a team as a code owner April 10, 2026 11:49
@elasticmachine
Copy link
Copy Markdown

elasticmachine commented Apr 10, 2026

Pinging @elastic/security-service-integrations (Team:Security-Service Integrations)

@elastic-vault-github-plugin-prod
Copy link
Copy Markdown

elastic-vault-github-plugin-prod bot commented Apr 10, 2026

🚀 Benchmarks report

To see the full report comment with /test benchmark fullreport

@elasticmachine
Copy link
Copy Markdown

elasticmachine commented Apr 10, 2026

💚 Build Succeeded

cc @kcreddy

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

@kcreddy kcreddy

Labels

enhancement New feature or request Integration:ti_custom Custom Threat Intelligence Team:Security-Service Integrations Security Service Integrations team [elastic/security-service-integrations]

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

[ti_custom] Add max_executions as a configurable parameter

2 participants

@kcreddy @elasticmachine