[qualys_gav] Set lookup index mode on latest asset transform for ES|QL LOOKUP JOIN

packages/qualys_gav/_dev/build/docs/README.md

@@ -45,6 +45,19 @@ For Rest API, this module has been tested against the **2.0** API version.
 4. Add all the required integration configuration parameters: URL, Username and Password.
 5. Save the integration.
 
+### Query-time asset enrichment (LOOKUP JOIN)
+
+When the integration is installed, a transform maintains the latest asset inventory per host in a lookup index (`logs-qualys_gav_latest.asset`). You can enrich other Qualys or security data with GAV asset metadata at query time using ES|QL [`LOOKUP JOIN`](https://www.elastic.co/docs/reference/query-languages/esql/commands/lookup-join) on `host.id`.
+
+Example enriching Qualys VMDR vulnerability data with GAV asset inventory:
+
+```esql
+FROM security_solution-qualys_vmdr.vulnerability_latest
+| LOOKUP JOIN logs-qualys_gav_latest.asset ON host.id
+```
+
+**Elasticsearch 9.1+** is required for `LOOKUP JOIN` against a lookup index. On releases before 9.1, `LOOKUP JOIN` must target the concrete transform destination index instead: in Kibana go to **Stack Management** → **Transforms**, open the Qualys GAV latest asset transform, and use the **destination_index** name shown there (that name can change with the integration version).
+
 ## Logs reference
 
 ### Asset

packages/qualys_gav/changelog.yml

@@ -1,4 +1,9 @@
 # newer versions go on top
+- version: "0.9.0"
+  changes:
+    - description: Configure the latest-asset transform destination with lookup index mode so it can be used as the right-hand side of ES|QL LOOKUP JOIN.
+      type: enhancement
+      link: https://github.com/elastic/integrations/issues/20067
 - version: "0.8.0"
   changes:
     - description: Use new `release` field for agentless deployment mode to establish as beta.

packages/qualys_gav/elasticsearch/transform/latest_asset/manifest.yml

@@ -1,5 +1,8 @@
 start: true
 destination_index_template:
+  settings:
+    index:
+      mode: lookup
   mappings:
     dynamic: true
     dynamic_templates:

packages/qualys_gav/elasticsearch/transform/latest_asset/transform.yml

@@ -33,5 +33,5 @@ _meta:
   managed: false
   # Bump this version to delete, reinstall, and restart the transform during
   # package installation.
-  fleet_transform_version: 0.2.0
+  fleet_transform_version: 0.3.0
   run_as_kibana_system: false

packages/qualys_gav/manifest.yml

@@ -1,7 +1,7 @@
-format_version: 3.3.2
+format_version: 3.4.0
 name: qualys_gav
 title: Qualys Global AssetView
-version: 0.8.0
+version: 0.9.0
 description: Collect logs from Qualys Global AssetView with Elastic Agent.
 type: integration
 categories: