[jumpcloud, forgerock, lastpass] Add Agentless Deployment

packages/forgerock/_dev/build/docs/README.md

@@ -2,6 +2,11 @@
 
 ForgeRock is a modern identity platform which helps organizations radically simplify identity and access management (IAM) and identity governance and administration (IGA). The ForgeRock integration collects audit logs from the [API](https://backstage.forgerock.com/knowledge/kb/article/a37739488).
 
+## Agentless Enabled Integration
+
+Agentless integrations allow you to collect data without having to manage Elastic Agent in your cloud. They make manual agent deployment unnecessary, so you can focus on your data instead of the agent that collects it. For more information, refer to [Agentless integrations](https://www.elastic.co/guide/en/serverless/current/security-agentless-integrations.html) and the [Agentless integrations FAQ](https://www.elastic.co/guide/en/serverless/current/agentless-integration-troubleshooting.html).
+Agentless deployments are only supported in Elastic Serverless and Elastic Cloud environments.  This functionality is in beta and is subject to change. Beta features are not subject to the support SLA of official GA features.
+
 ### Configuration
 
 Authorization parameters for the ForgeRock Identity Cloud API (`API Key ID`, and `API Key Secret`) can be created [in the Identity Cloud admin UI](https://backstage.forgerock.com/docs/idcloud/latest/developer-docs/authenticate-to-rest-api-with-api-key-and-secret.html#get_an_api_key_and_secret). 

packages/forgerock/changelog.yml

@@ -1,4 +1,9 @@
 # newer versions go on top
+- version: "1.23.0"
+  changes:
+    - description: Enable Agentless deployment.
+      type: enhancement
+      link: https://github.com/elastic/integrations/pull/19205
 - version: "1.22.0"
   changes:
     - description: Prevent updating fleet health status to degraded.

packages/forgerock/data_stream/am_access/elasticsearch/ingest_pipeline/default.yml

@@ -12,6 +12,13 @@ processors:
       target_field: event.original
       ignore_missing: true
       if: ctx.event?.original == null
+
+  - remove:
+      field: message
+      tag: remove_message
+      ignore_missing: true
+      if: ctx.event?.original != null
+      description: 'The `message` field is no longer required if the document has an `event.original` field.'
   - json:
       field: event.original
       target_field: json

packages/forgerock/data_stream/am_activity/elasticsearch/ingest_pipeline/default.yml

@@ -12,6 +12,13 @@ processors:
       target_field: event.original
       ignore_missing: true
       if: ctx.event?.original == null
+
+  - remove:
+      field: message
+      tag: remove_message
+      ignore_missing: true
+      if: ctx.event?.original != null
+      description: 'The `message` field is no longer required if the document has an `event.original` field.'
   - json:
       field: event.original
       target_field: json

packages/forgerock/data_stream/am_authentication/elasticsearch/ingest_pipeline/default.yml

@@ -12,6 +12,13 @@ processors:
       target_field: event.original
       ignore_missing: true
       if: ctx.event?.original == null
+
+  - remove:
+      field: message
+      tag: remove_message
+      ignore_missing: true
+      if: ctx.event?.original != null
+      description: 'The `message` field is no longer required if the document has an `event.original` field.'
   - json:
       field: event.original
       target_field: json

packages/forgerock/data_stream/am_config/elasticsearch/ingest_pipeline/default.yml

@@ -12,6 +12,13 @@ processors:
       target_field: event.original
       ignore_missing: true
       if: ctx.event?.original == null
+
+  - remove:
+      field: message
+      tag: remove_message
+      ignore_missing: true
+      if: ctx.event?.original != null
+      description: 'The `message` field is no longer required if the document has an `event.original` field.'
   - json:
       field: event.original
       target_field: json

packages/forgerock/data_stream/am_core/elasticsearch/ingest_pipeline/default.yml

@@ -12,6 +12,13 @@ processors:
       target_field: event.original
       ignore_missing: true
       if: ctx.event?.original == null
+
+  - remove:
+      field: message
+      tag: remove_message
+      ignore_missing: true
+      if: ctx.event?.original != null
+      description: 'The `message` field is no longer required if the document has an `event.original` field.'
   - json:
       field: event.original
       target_field: json

packages/forgerock/data_stream/idm_access/elasticsearch/ingest_pipeline/default.yml

@@ -12,6 +12,13 @@ processors:
       target_field: event.original
       ignore_missing: true
       if: ctx.event?.original == null
+
+  - remove:
+      field: message
+      tag: remove_message
+      ignore_missing: true
+      if: ctx.event?.original != null
+      description: 'The `message` field is no longer required if the document has an `event.original` field.'
   - json:
       field: event.original
       target_field: json

packages/forgerock/data_stream/idm_activity/elasticsearch/ingest_pipeline/default.yml

@@ -12,6 +12,13 @@ processors:
       target_field: event.original
       ignore_missing: true
       if: ctx.event?.original == null
+
+  - remove:
+      field: message
+      tag: remove_message
+      ignore_missing: true
+      if: ctx.event?.original != null
+      description: 'The `message` field is no longer required if the document has an `event.original` field.'
   - json:
       field: event.original
       target_field: json

packages/forgerock/data_stream/idm_authentication/elasticsearch/ingest_pipeline/default.yml

@@ -12,6 +12,13 @@ processors:
       target_field: event.original
       ignore_missing: true
       if: ctx.event?.original == null
+
+  - remove:
+      field: message
+      tag: remove_message
+      ignore_missing: true
+      if: ctx.event?.original != null
+      description: 'The `message` field is no longer required if the document has an `event.original` field.'
   - json:
       field: event.original
       target_field: json

packages/forgerock/data_stream/idm_config/elasticsearch/ingest_pipeline/default.yml

@@ -12,6 +12,13 @@ processors:
       target_field: event.original
       ignore_missing: true
       if: ctx.event?.original == null
+
+  - remove:
+      field: message
+      tag: remove_message
+      ignore_missing: true
+      if: ctx.event?.original != null
+      description: 'The `message` field is no longer required if the document has an `event.original` field.'
   - json:
       field: event.original
       target_field: json

packages/forgerock/data_stream/idm_core/elasticsearch/ingest_pipeline/default.yml

@@ -12,6 +12,13 @@ processors:
       target_field: event.original
       ignore_missing: true
       if: ctx.event?.original == null
+
+  - remove:
+      field: message
+      tag: remove_message
+      ignore_missing: true
+      if: ctx.event?.original != null
+      description: 'The `message` field is no longer required if the document has an `event.original` field.'
   - json:
       field: event.original
       target_field: forgerock

packages/forgerock/data_stream/idm_sync/elasticsearch/ingest_pipeline/default.yml

@@ -12,6 +12,13 @@ processors:
       target_field: event.original
       ignore_missing: true
       if: ctx.event?.original == null
+
+  - remove:
+      field: message
+      tag: remove_message
+      ignore_missing: true
+      if: ctx.event?.original != null
+      description: 'The `message` field is no longer required if the document has an `event.original` field.'
   - json:
       field: event.original
       target_field: json

packages/forgerock/docs/README.md

@@ -2,6 +2,11 @@
 
 ForgeRock is a modern identity platform which helps organizations radically simplify identity and access management (IAM) and identity governance and administration (IGA). The ForgeRock integration collects audit logs from the [API](https://backstage.forgerock.com/knowledge/kb/article/a37739488).
 
+## Agentless Enabled Integration
+
+Agentless integrations allow you to collect data without having to manage Elastic Agent in your cloud. They make manual agent deployment unnecessary, so you can focus on your data instead of the agent that collects it. For more information, refer to [Agentless integrations](https://www.elastic.co/guide/en/serverless/current/security-agentless-integrations.html) and the [Agentless integrations FAQ](https://www.elastic.co/guide/en/serverless/current/agentless-integration-troubleshooting.html).
+Agentless deployments are only supported in Elastic Serverless and Elastic Cloud environments.  This functionality is in beta and is subject to change. Beta features are not subject to the support SLA of official GA features.
+
 ### Configuration
 
 Authorization parameters for the ForgeRock Identity Cloud API (`API Key ID`, and `API Key Secret`) can be created [in the Identity Cloud admin UI](https://backstage.forgerock.com/docs/idcloud/latest/developer-docs/authenticate-to-rest-api-with-api-key-and-secret.html#get_an_api_key_and_secret). 

packages/forgerock/manifest.yml

@@ -1,9 +1,9 @@
 name: forgerock
 title: "ForgeRock"
-version: "1.22.0"
+version: "1.23.0"
 description: Collect audit logs from ForgeRock with Elastic Agent.
 type: integration
-format_version: "3.0.2"
+format_version: "3.3.2"
 categories: ["security"]
 conditions:
   kibana:
@@ -17,6 +17,14 @@ policy_templates:
   - name: forgerock
     title: Collect ForgeRock logs via API
     description: Collecting ForgeRock logs via API with Elastic Agent.
+    deployment_modes:
+      default:
+        enabled: true
+      agentless:
+        enabled: true
+        organization: security
+        division: engineering
+        team: security-service-integrations
     inputs:
       - type: httpjson
         title: Collect ForgeRock logs via API

packages/jumpcloud/_dev/build/docs/README.md

@@ -4,6 +4,11 @@ The JumpCloud integration allows you to monitor events related to the JumpCloud
 
 You can find out more about JumpCloud and JumpCloud Directory Insights [here](https://jumpcloud.com/platform/directory-insights)
 
+## Agentless Enabled Integration
+
+Agentless integrations allow you to collect data without having to manage Elastic Agent in your cloud. They make manual agent deployment unnecessary, so you can focus on your data instead of the agent that collects it. For more information, refer to [Agentless integrations](https://www.elastic.co/guide/en/serverless/current/security-agentless-integrations.html) and the [Agentless integrations FAQ](https://www.elastic.co/guide/en/serverless/current/agentless-integration-troubleshooting.html).
+Agentless deployments are only supported in Elastic Serverless and Elastic Cloud environments.  This functionality is in beta and is subject to change. Beta features are not subject to the support SLA of official GA features.
+
 ## Data streams
 
 A single data stream named "jumpcloud.events" is used by this integration.

packages/jumpcloud/changelog.yml

@@ -1,4 +1,9 @@
 # newer versions go on top
+- version: "1.20.0"
+  changes:
+    - description: Enable Agentless deployment.
+      type: enhancement
+      link: https://github.com/elastic/integrations/pull/19205
 - version: "1.19.0"
   changes:
     - description: Add description to the Starting point configuration option.

packages/jumpcloud/data_stream/events/elasticsearch/ingest_pipeline/default.yml

@@ -9,6 +9,12 @@ processors:
       target_field: event.original
       ignore_missing: true
       if: ctx.event?.original == null
+  - remove:
+      field: message
+      tag: remove_message
+      ignore_missing: true
+      if: ctx.event?.original != null
+      description: 'The `message` field is no longer required if the document has an `event.original` field.'
   - json:
       field: event.original
       target_field: json

packages/jumpcloud/docs/README.md

@@ -4,6 +4,11 @@ The JumpCloud integration allows you to monitor events related to the JumpCloud
 
 You can find out more about JumpCloud and JumpCloud Directory Insights [here](https://jumpcloud.com/platform/directory-insights)
 
+## Agentless Enabled Integration
+
+Agentless integrations allow you to collect data without having to manage Elastic Agent in your cloud. They make manual agent deployment unnecessary, so you can focus on your data instead of the agent that collects it. For more information, refer to [Agentless integrations](https://www.elastic.co/guide/en/serverless/current/security-agentless-integrations.html) and the [Agentless integrations FAQ](https://www.elastic.co/guide/en/serverless/current/agentless-integration-troubleshooting.html).
+Agentless deployments are only supported in Elastic Serverless and Elastic Cloud environments.  This functionality is in beta and is subject to change. Beta features are not subject to the support SLA of official GA features.
+
 ## Data streams
 
 A single data stream named "jumpcloud.events" is used by this integration.

packages/jumpcloud/manifest.yml

@@ -1,15 +1,15 @@
-format_version: "3.0.2"
+format_version: "3.3.2"
 name: jumpcloud
 title: "JumpCloud"
-version: "1.19.0"
+version: "1.20.0"
 description: "Collect logs from JumpCloud Directory as a Service"
 type: integration
 categories:
   - cloud
   - security
 conditions:
   kibana:
-    version: "^8.13.0 || ^9.0.0"
+    version: "^8.19.2 || ^9.0.5"
   elastic:
     subscription: "basic"
 screenshots:
@@ -26,6 +26,14 @@ policy_templates:
   - name: jumpcloud
     title: JumpCloud Events
     description: Collect JumpCloud Directory as a Service Events
+    deployment_modes:
+      default:
+        enabled: true
+      agentless:
+        enabled: true
+        organization: security
+        division: engineering
+        team: security-service-integrations
     inputs:
       - type: httpjson
         title: Poll Directory Insights API for Events

packages/lastpass/_dev/build/docs/README.md

@@ -4,6 +4,11 @@
 
 The [LastPass](https://www.lastpass.com/) integration allows users to monitor Detailed Shared Folder Data, User Data, and Event Report Logs. LastPass is a cloud-based password manager that stores users' login information online in a secure database and allows users to generate unique passwords for each site they visit. In addition, LastPass stores all users' passwords and enables them to log into their accounts with ease. It’s available on all major platforms, including mobile devices, computers, and browser extensions.
 
+## Agentless Enabled Integration
+
+Agentless integrations allow you to collect data without having to manage Elastic Agent in your cloud. They make manual agent deployment unnecessary, so you can focus on your data instead of the agent that collects it. For more information, refer to [Agentless integrations](https://www.elastic.co/guide/en/serverless/current/security-agentless-integrations.html) and the [Agentless integrations FAQ](https://www.elastic.co/guide/en/serverless/current/agentless-integration-troubleshooting.html).
+Agentless deployments are only supported in Elastic Serverless and Elastic Cloud environments.  This functionality is in beta and is subject to change. Beta features are not subject to the support SLA of official GA features.
+
 ## Data streams
 
 The LastPass integration collects logs for three types of events: Detailed Shared Folder Data, User Data, and Event Report.

packages/lastpass/changelog.yml

@@ -1,4 +1,9 @@
 # newer versions go on top
+- version: "1.22.0"
+  changes:
+    - description: Enable Agentless deployment.
+      type: enhancement
+      link: https://github.com/elastic/integrations/pull/19205
 - version: "1.21.0"
   changes:
     - description: Prevent updating fleet health status to degraded when pagination completes.

packages/lastpass/data_stream/detailed_shared_folder/elasticsearch/ingest_pipeline/default.yml

@@ -9,6 +9,12 @@ processors:
       target_field: event.original
       ignore_missing: true
       if: ctx.event?.original == null
+  - remove:
+      field: message
+      tag: remove_message
+      ignore_missing: true
+      if: ctx.event?.original != null
+      description: 'The `message` field is no longer required if the document has an `event.original` field.'
   - json:
       field: event.original
       target_field: json

packages/lastpass/data_stream/event_report/elasticsearch/ingest_pipeline/default.yml

@@ -9,6 +9,12 @@ processors:
       target_field: event.original
       ignore_missing: true
       if: ctx.event?.original == null
+  - remove:
+      field: message
+      tag: remove_message
+      ignore_missing: true
+      if: ctx.event?.original != null
+      description: 'The `message` field is no longer required if the document has an `event.original` field.'
   - json:
       field: event.original
       target_field: json

packages/lastpass/data_stream/user/elasticsearch/ingest_pipeline/default.yml

@@ -9,6 +9,12 @@ processors:
       target_field: event.original
       ignore_missing: true
       if: ctx.event?.original == null
+  - remove:
+      field: message
+      tag: remove_message
+      ignore_missing: true
+      if: ctx.event?.original != null
+      description: 'The `message` field is no longer required if the document has an `event.original` field.'
   - json:
       field: event.original
       target_field: json

packages/lastpass/docs/README.md

@@ -4,6 +4,11 @@
 
 The [LastPass](https://www.lastpass.com/) integration allows users to monitor Detailed Shared Folder Data, User Data, and Event Report Logs. LastPass is a cloud-based password manager that stores users' login information online in a secure database and allows users to generate unique passwords for each site they visit. In addition, LastPass stores all users' passwords and enables them to log into their accounts with ease. It’s available on all major platforms, including mobile devices, computers, and browser extensions.
 
+## Agentless Enabled Integration
+
+Agentless integrations allow you to collect data without having to manage Elastic Agent in your cloud. They make manual agent deployment unnecessary, so you can focus on your data instead of the agent that collects it. For more information, refer to [Agentless integrations](https://www.elastic.co/guide/en/serverless/current/security-agentless-integrations.html) and the [Agentless integrations FAQ](https://www.elastic.co/guide/en/serverless/current/agentless-integration-troubleshooting.html).
+Agentless deployments are only supported in Elastic Serverless and Elastic Cloud environments.  This functionality is in beta and is subject to change. Beta features are not subject to the support SLA of official GA features.
+
 ## Data streams
 
 The LastPass integration collects logs for three types of events: Detailed Shared Folder Data, User Data, and Event Report.

packages/lastpass/manifest.yml

@@ -1,7 +1,7 @@
-format_version: "3.0.2"
+format_version: "3.3.2"
 name: lastpass
 title: LastPass
-version: "1.21.0"
+version: "1.22.0"
 description: Collect logs from LastPass with Elastic Agent.
 type: integration
 categories:
@@ -26,6 +26,14 @@ policy_templates:
   - name: lastpass
     title: LastPass
     description: Collect logs from LastPass.
+    deployment_modes:
+      default:
+        enabled: true
+      agentless:
+        enabled: true
+        organization: security
+        division: engineering
+        team: security-service-integrations
     inputs:
       - type: httpjson
         title: Collect LastPass logs via API