[blacklens] Add Agentless Deployment Support

[mohitjha-elastic]

Description

Add agentless support to the blacklens.

Requirements

Following the established Phase I pattern, for each integration see the Onboarding Integration Guide.

1. Technical implementation

• Update integration manifest.yml to enable agentless deployment mode ()
• Update integration documentation with agentless deployment instructions
• Update changelog.md

Example reference: #13367

2. Performance documentation

• Test and document throughput in agentless (requires access to vendor environment and/or sample data)
• Document specific metrics for each integration. For example/where possible:
  • API response time: Average time for vendor API calls to complete
  • Events processed per minute: How many log entries/events the integration can handle
  • Error rates: Percentage of failed API calls or data processing errors
  • Container resource usage: CPU and memory consumption under typical load
  • Vendor-specific limits: Rate limiting thresholds and API quotas

Example documentation format: "Crowdstrike Falcon Intelligence: 200ms avg API response, 5,000 events/min, 0.1% error rate, 512MB RAM/0.5CPU, 1000 API calls/hour limit"

Dependencies

• Agentless infrastructure GA readiness (still in beta)
• Input compatibility: Currently agentless is optimized for httpjson and cel inputs
• UX enhancement: Add agentless deployment filter/toggle to integrations catalog page for better discoverability

[elasticmachine]

Pinging @elastic/security-service-integrations (Team:Security-Service Integrations)

[github-actions]

TL;DR: blacklens is not agentless-enabled yet, and the cleanest path is to implement the same 3-part pattern already merged for similar integrations: manifest.yml deployment modes + docs agentless section + changelog/version bump.

Recommendation

Proceed with a standard Phase I agentless rollout for packages/blacklens using the same structure as recently merged security-service-integrations packages (for example abnormal_security and authentik). The package already uses httpjson, so it meets the stated input compatibility prerequisite.

Findings

1. blacklens currently has no agentless deployment block in package manifest:
   • packages/blacklens/manifest.yml:28-35 (policy template exists with inputs: - type: httpjson)
   • no deployment_modes/agentless entries present in that file.
2. blacklens docs do not contain agentless deployment guidance yet:
   • packages/blacklens/docs/README.md:1-45
   • packages/blacklens/_dev/build/docs/README.md:1-43
3. blacklens changelog has no agentless entry yet:
   • packages/blacklens/changelog.yml:1-11
4. Precedent manifests use the same agentless metadata keys/values:
   • packages/abnormal_security/manifest.yml:57-64
   • packages/authentik/manifest.yml:34-41
   • packages/github/manifest.yml:53-60
   • common shape includes:
     • deployment_modes.default.enabled: true
     • deployment_modes.agentless.enabled: true
     • organization: security, division: engineering, team: security-service-integrations
5. Repo conventions relevant to implementation:
   • docs/extend/tips-for-building.md:207 indicates docs/README.md is generally generated from _dev/build/docs/README.md.
   • docs/extend/manifest-spec.md:273-276 requires organization/division/team when agentless is enabled.

Verification

I verified current state and precedents with repository searches:

$ grep -nE "deployment_modes|agentless" packages/blacklens/manifest.yml
(no matches)

$ grep -n "type: httpjson" packages/blacklens/manifest.yml packages/blacklens/data_stream/alerts/manifest.yml
packages/blacklens/manifest.yml:33:      - type: httpjson

$ grep -nE "deployment_modes|agentless|organization: security|division: engineering|team: security-service-integrations" packages/{abnormal_security,authentik,github}/manifest.yml
packages/abnormal_security/manifest.yml:57:    deployment_modes:
packages/abnormal_security/manifest.yml:60:      agentless:
packages/abnormal_security/manifest.yml:62:        organization: security
packages/abnormal_security/manifest.yml:63:        division: engineering
packages/abnormal_security/manifest.yml:64:        team: security-service-integrations
packages/authentik/manifest.yml:34:    deployment_modes:
packages/authentik/manifest.yml:37:      agentless:
packages/authentik/manifest.yml:39:        organization: security
packages/authentik/manifest.yml:40:        division: engineering
packages/authentik/manifest.yml:41:        team: security-service-integrations
packages/github/manifest.yml:53:    deployment_modes:
packages/github/manifest.yml:56:      agentless:
packages/github/manifest.yml:58:        organization: security
packages/github/manifest.yml:59:        division: engineering
packages/github/manifest.yml:60:        team: security-service-integrations

Detailed Action Plan

1. Update packages/blacklens/manifest.yml:
   • under policy_templates[0], add:
     • deployment_modes.default.enabled: true
     • deployment_modes.agentless.enabled: true
     • organization/division/team metadata using the established values above.
   • bump package version (minor bump is typical for this feature addition; maintainers can confirm exact target).
2. Update docs template first: packages/blacklens/_dev/build/docs/README.md:
   • add an Agentless Enabled Integration section matching existing package wording.
   • include the beta disclaimer used by precedent packages.
   • include a short note for performance metrics status (if not benchmarked yet, explicitly state pending benchmark).
3. Regenerate packages/blacklens/docs/README.md from the _dev/build/docs/README.md source.
4. Prepend packages/blacklens/changelog.yml entry with new version:
   • type: enhancement
   • description aligned with convention (for example: Enable Agentless deployment.)
   • add PR link once PR exists.
5. Open PR referencing this issue and include any benchmark numbers if vendor environment testing is available; otherwise, track performance metrics as a follow-up task.

Related Items

Type	Link	Relevance
Issue	#18655	Current request
Issue	#17538	Same request pattern completed for abnormal_security
PR	#18249	Merged implementation for abnormal_security agentless rollout
Issue	#18369	Same request pattern completed for authentik
PR	#18387	Merged implementation for authentik agentless rollout
File	packages/blacklens/manifest.yml	Missing deployment_modes.agentless
File	packages/blacklens/_dev/build/docs/README.md	Canonical docs source to update for agentless instructions
File	packages/blacklens/changelog.yml	Needs new enhancement entry for agentless support
Spec	docs/extend/manifest-spec.md:273-276	Agentless enabled requires organization/division/team

Note

🔒 Integrity filter blocked 46 items

The following items were blocked because they don't meet the GitHub integrity level.

• #13367 search_pull_requests: has lower integrity than agent requires. The agent cannot read data with integrity below "approved".
• #10213 search_pull_requests: has lower integrity than agent requires. The agent cannot read data with integrity below "approved".
• #17560 search_pull_requests: has lower integrity than agent requires. The agent cannot read data with integrity below "approved".
• #13085 search_pull_requests: has lower integrity than agent requires. The agent cannot read data with integrity below "approved".
• #17973 search_issues: has lower integrity than agent requires. The agent cannot read data with integrity below "approved".
• #17973 issue_read: has lower integrity than agent requires. The agent cannot read data with integrity below "approved".
• #18533 search_issues: has lower integrity than agent requires. The agent cannot read data with integrity below "approved".
• #18401 search_issues: has lower integrity than agent requires. The agent cannot read data with integrity below "approved".
• #18374 search_issues: has lower integrity than agent requires. The agent cannot read data with integrity below "approved".
• #15452 search_issues: has lower integrity than agent requires. The agent cannot read data with integrity below "approved".
• #18294 search_issues: has lower integrity than agent requires. The agent cannot read data with integrity below "approved".
• #15417 search_issues: has lower integrity than agent requires. The agent cannot read data with integrity below "approved".
• #15381 search_issues: has lower integrity than agent requires. The agent cannot read data with integrity below "approved".
• #15330 search_issues: has lower integrity than agent requires. The agent cannot read data with integrity below "approved".
• #17292 search_issues: has lower integrity than agent requires. The agent cannot read data with integrity below "approved".
• #14186 search_issues: has lower integrity than agent requires. The agent cannot read data with integrity below "approved".
• ... and 30 more items

To allow these resources, lower min-integrity in your GitHub frontmatter:

tools:
  github:
    min-integrity: approved  # merged | approved | unapproved | none

---

What is this? | From workflow: Issue Triage

Give us feedback! React with 🚀 if perfect, 👍 if helpful, 👎 if not.