[ti_rapid7_threat_command] Add Agentless Deployment

packages/ti_rapid7_threat_command/_dev/build/docs/README.md

@@ -4,6 +4,11 @@
 
 The [Rapid7 Threat Command](https://www.rapid7.com/) integration allows users to retrieve IOCs (Indicator of Compromises), organization-specific Threat Command alerts, and CVEs (Common Vulnerabilities and Exposures). Furthermore, the correlation between data collected from the Rapid7 Threat Command platform (IOCs and CVEs) and the user's environment helps to identify threats. Rapid7 Threat Command platform gives protectors the tools and clarity they need to assess their attack surface, detect suspicious behavior, and respond and remediate quickly with intelligent automation.
 
+## Agentless Enabled Integration
+
+Agentless integrations allow you to collect data without having to manage Elastic Agent in your cloud. They make manual agent deployment unnecessary, so you can focus on your data instead of the agent that collects it. For more information, refer to [Agentless integrations](https://www.elastic.co/guide/en/serverless/current/security-agentless-integrations.html) and the [Agentless integrations FAQ](https://www.elastic.co/guide/en/serverless/current/agentless-integration-troubleshooting.html).
+Agentless deployments are only supported in Elastic Serverless and Elastic Cloud environments.  This functionality is in beta and is subject to change. Beta features are not subject to the support SLA of official GA features.
+
 ## Data streams
 
 The Rapid7 Threat Command integration collects three types of data: ioc, alert, and vulnerability.
@@ -17,7 +22,7 @@ The Rapid7 Threat Command integration collects three types of data: ioc, alert,
 ## Compatibility
 
 - This integration has been tested against Rapid7 Threat Command `IOC API v2`, `Alert API v1`, and `Vulnerability API v1`.
-- Rapid7 Threat Command integration is compatible with Elastic stack `v8.12.0` and newer.
+- Rapid7 Threat Command integration is compatible with Elastic stack `v8.19.4` and newer.
 
 ## Requirements
 

packages/ti_rapid7_threat_command/changelog.yml

@@ -1,4 +1,9 @@
 # newer versions go on top
+- version: "2.8.0"
+  changes:
+    - description: Enable Agentless deployment.
+      type: enhancement
+      link: https://github.com/elastic/integrations/pull/18331
 - version: "2.7.1"
   changes:
     - description: Remove duplicate security-solution-default tag references

packages/ti_rapid7_threat_command/data_stream/alert/elasticsearch/ingest_pipeline/default.yml

@@ -6,6 +6,12 @@ processors:
       target_field: event.original
       ignore_missing: true
       if: ctx.event?.original == null
+  - remove:
+      field: message
+      tag: remove_message
+      ignore_missing: true
+      if: ctx.event?.original != null
+      description: 'The `message` field is no longer required if the document has an `event.original` field.'
   - set:
       field: ecs.version
       value: 8.11.0

packages/ti_rapid7_threat_command/data_stream/ioc/elasticsearch/ingest_pipeline/default.yml

@@ -6,6 +6,12 @@ processors:
       target_field: event.original
       ignore_missing: true
       if: ctx.event?.original == null
+  - remove:
+      field: message
+      tag: remove_message
+      ignore_missing: true
+      if: ctx.event?.original != null
+      description: 'The `message` field is no longer required if the document has an `event.original` field.'
   - set:
       field: ecs.version
       value: 8.11.0

packages/ti_rapid7_threat_command/data_stream/vulnerability/elasticsearch/ingest_pipeline/default.yml

@@ -6,6 +6,12 @@ processors:
       target_field: event.original
       ignore_missing: true
       if: ctx.event?.original == null
+  - remove:
+      field: message
+      tag: remove_message
+      ignore_missing: true
+      if: ctx.event?.original != null
+      description: 'The `message` field is no longer required if the document has an `event.original` field.'
   - set:
       field: ecs.version
       value: 8.11.0

packages/ti_rapid7_threat_command/docs/README.md

@@ -4,6 +4,11 @@
 
 The [Rapid7 Threat Command](https://www.rapid7.com/) integration allows users to retrieve IOCs (Indicator of Compromises), organization-specific Threat Command alerts, and CVEs (Common Vulnerabilities and Exposures). Furthermore, the correlation between data collected from the Rapid7 Threat Command platform (IOCs and CVEs) and the user's environment helps to identify threats. Rapid7 Threat Command platform gives protectors the tools and clarity they need to assess their attack surface, detect suspicious behavior, and respond and remediate quickly with intelligent automation.
 
+## Agentless Enabled Integration
+
+Agentless integrations allow you to collect data without having to manage Elastic Agent in your cloud. They make manual agent deployment unnecessary, so you can focus on your data instead of the agent that collects it. For more information, refer to [Agentless integrations](https://www.elastic.co/guide/en/serverless/current/security-agentless-integrations.html) and the [Agentless integrations FAQ](https://www.elastic.co/guide/en/serverless/current/agentless-integration-troubleshooting.html).
+Agentless deployments are only supported in Elastic Serverless and Elastic Cloud environments.  This functionality is in beta and is subject to change. Beta features are not subject to the support SLA of official GA features.
+
 ## Data streams
 
 The Rapid7 Threat Command integration collects three types of data: ioc, alert, and vulnerability.
@@ -17,7 +22,7 @@ The Rapid7 Threat Command integration collects three types of data: ioc, alert,
 ## Compatibility
 
 - This integration has been tested against Rapid7 Threat Command `IOC API v2`, `Alert API v1`, and `Vulnerability API v1`.
-- Rapid7 Threat Command integration is compatible with Elastic stack `v8.12.0` and newer.
+- Rapid7 Threat Command integration is compatible with Elastic stack `v8.19.4` and newer.
 
 ## Requirements
 

packages/ti_rapid7_threat_command/manifest.yml

@@ -1,7 +1,7 @@
-format_version: 3.0.2
+format_version: 3.3.2
 name: ti_rapid7_threat_command
 title: Rapid7 Threat Command
-version: "2.7.1"
+version: "2.8.0"
 description: Collect threat intelligence from Threat Command API with Elastic Agent.
 type: integration
 categories:
@@ -45,6 +45,17 @@ policy_templates:
   - name: ti_rapid7_threat_command
     title: Rapid7 Threat Command
     description: Collect Threat Intel data from Rapid7 Threat Command.
+    deployment_modes:
+      default:
+        enabled: true
+      agentless:
+        enabled: true
+        organization: security
+        division: engineering
+        team: security-service-integrations
+        resources:
+          requests:
+            memory: 4Gi
     inputs:
       - type: httpjson
         title: Collect Threat Intel data via Rapid7 Threat Command API