Remove Security Category Tag from Non-Security Packages #15611

JDKurma · 2025-10-09T05:46:49Z

Proposed commit message

The following packages are categorized as security despite not being semantically related to security nor having security related datastreams:

[
  "miniflux",
  "mongodb",
  "mysql"
]

Datastreams:

[
  {
    "package": "miniflux",
    "datastream": "miniflux.feed_entry"
  },
  {
    "package": "mongodb",
    "datastream": "mongodb.collstats"
  },
  {
    "package": "mongodb",
    "datastream": "mongodb.dbstats"
  },
  {
    "package": "mongodb",
    "datastream": "mongodb.log"
  },
  {
    "package": "mongodb",
    "datastream": "mongodb.metrics"
  },
  {
    "package": "mongodb",
    "datastream": "mongodb.replstatus"
  },
  {
    "package": "mongodb",
    "datastream": "mongodb.status"
  },
  {
    "package": "mysql",
    "datastream": "mysql.error"
  },
  {
    "package": "mysql",
    "datastream": "mysql.galera_status"
  },
  {
    "package": "mysql",
    "datastream": "mysql.performance"
  },
  {
    "package": "mysql",
    "datastream": "mysql.replica_status"
  },
  {
    "package": "mysql",
    "datastream": "mysql.slowlog"
  },
  {
    "package": "mysql",
    "datastream": "mysql.status"
  }
]

I've removed the security tag for the above mentioned packages to accurately categorize them.

Checklist

I have reviewed tips for building integrations and this pull request is aligned with them.
I have verified that all data streams collect metrics or logs.
I have added an entry to my package's changelog.yml file.
I have verified that Kibana version constraints are current according to guidelines.
I have verified that any added dashboard complies with Kibana's Dashboard good practices

Author's Checklist

[ ]

How to test this PR locally

Related issues

[Enhancement] Update categories for packages #14571

Screenshots

elasticmachine · 2025-10-09T16:00:39Z

Pinging @elastic/security-service-integrations (Team:Security-Service Integrations)

efd6 · 2025-10-09T22:58:22Z

packages/miniflux/manifest.yml

-  # Added security category as Miniflux integration is assigned to security team
-  - security


@clement-fouque Do you recall why this was added as a security integration?

I think we had a discussion but I don't remember why we added it. We can remove it.

It is owned by security team, has it no security use case?

efd6 · 2025-10-09T22:59:13Z

packages/aws_bedrock/manifest.yml

  - aws
  - cloud
  - observability
-  - security


@Mikaayenson What's your view on whether the bedrock integration is a security product?

We do have prebuilt security detection rules that leverage this integration.

This is the same case for azure_openai.

Note: We have some PRs in the work to further codify security related genai fields. See:

Stage 0: [RFC] Stage 0: Add additional GenAI fields ecs#2519

Stage 1: [RFC 0052] Stage 1: Update GenAI fields ecs#2525

Stage 2: [RFC 0052] Stage 2: Update additional GenAI fields ecs#2532

Reverted the changes for those!

elastic-vault-github-plugin-prod · 2025-10-10T20:22:51Z

🚀 Benchmarks report

Package `miniflux` 👍(0) 💚(0) 💔(1)

Expand to view

Data stream	Previous EPS	New EPS	Diff (%)	Result
`feed_entry`	2020.2	1557.63	-462.57 (-22.9%)	💔

Package `mongodb` 👍(0) 💚(0) 💔(1)

Expand to view

Data stream	Previous EPS	New EPS	Diff (%)	Result
`log`	26315.79	22222.22	-4093.57 (-15.56%)	💔

Package `mysql` 👍(1) 💚(0) 💔(2)

Expand to view

Data stream	Previous EPS	New EPS	Diff (%)	Result
`error`	27027.03	15625	-11402.03 (-42.19%)	💔
`slowlog`	21739.13	17543.86	-4195.27 (-19.3%)	💔

To see the full report comment with /test benchmark fullreport

muthu-mps · 2025-10-14T05:07:03Z

azure_app_service logs include the AppServiceIPSecAuditLogs, AppServiceAuditLogs and AppServiceHTTPLogs categories. This integration can be tagged with security category.
Azure AI Foundry is an enhanced version of Azure OpenAI that currently enables monitoring of both third-party models and Azure OpenAI models. @Mikaayenson - Do you think the threat detection rule implementation can be done for AI Foundry similar to Azure OpenAI? If yes, Then this integration can get tagged with security category similar to Azure OpenAI.

Mikaayenson · 2025-10-14T11:01:32Z

azure_app_service logs include the AppServiceIPSecAuditLogs, AppServiceAuditLogs and AppServiceHTTPLogs categories. This integration can be tagged with security category.

Azure AI Foundry is an enhanced version of Azure OpenAI that currently enables monitoring of both third-party models and Azure OpenAI models. @Mikaayenson - Do you think the threat detection rule implementation can be done for AI Foundry similar to Azure OpenAI? If yes, Then this integration can get tagged with security category similar to Azure OpenAI.

Yes, we just do not yet have any prebuilt rules for this integration. And if we ever get a gemini integration that would too.

JDKurma · 2025-10-14T16:53:28Z

@muthu-mps removed both!

packages/cisco_meraki_metrics/manifest.yml

trisch-me

lgtm apart from 1 change

lalit-satapathy · 2025-10-17T03:36:11Z

packages/miniflux/manifest.yml

-  # Added security category as Miniflux integration is assigned to security team
-  - security


It is owned by security team, has it no security use case?

lalit-satapathy · 2025-10-17T03:36:23Z

packages/mongodb/manifest.yml

-  # Added database_security category as it collects database logs and metrics including collection statistics, database statistics, and replication status
-  - database_security
-  # Added global security category as this integration collects security-relevant data
-  - security


lalit-satapathy · 2025-10-17T03:36:30Z

packages/mysql/manifest.yml

-  # Added database_security category as it collects error logs, slow query logs, and replication status metrics that are relevant for database security monitoring
-  - database_security
-  # Added global security category as this integration collects security-relevant data
-  - security


packages/cisco_meraki_metrics/manifest.yml

daniela-elastic · 2025-10-17T11:55:01Z

CC @jamiehynds There was a whole re-categorization effort done recently to more effectively label the various use cases for each integration (see PR). As a result, additional solution categories were added to some integrations.

The bigger picture:
A decision of how we label an integration (o11y or security) is how customers ultimately use it. Today there are integrations that are effectively used for both but are mis-labled as only catering to one use case. For example, recently speaking with field team revealed that the Netflow integration is being used by customers and sold as a through-and-through observability integration, however it is not labeled as such (see manifest file)

Next steps:
@jamiehynds it would be worth for sec and o11y to align on the usefuless and intended purpose of the solution category. This can help drive more clarity and easier decision making on the correct labelling.

JDKurma · 2025-10-20T20:42:29Z

@lalit-satapathy miniflux doesn't have any detection rules for it and just has 1 datastream for a rss feed entry.

cisco_meraki_metrics appears only o11y and has no detection rules for it; however, I'll revert it just to be safe per @trisch-me recommendation

daniela-elastic · 2025-10-20T21:22:25Z

If miniflux is not a security integration and it never was considered an observability integration then what type of integration is it?

trisch-me · 2025-10-21T08:17:54Z

If miniflux is not a security integration and it never was considered an observability integration then what type of integration is it?

@norrietaylor or @jamiehynds any help with this integration? I have also checked telemetry and we had no trace of this integration to be used by customers for last year or so

elasticmachine · 2025-10-21T09:01:47Z

💚 Build Succeeded

Buildkite Build
Commit: 5ccbd87

History

💚 Build #32920 succeeded 081acaf
💚 Build #32791 succeeded 9d42d2b
💚 Build #32787 succeeded b918827
💚 Build #32735 succeeded ec75bb4
💚 Build #32723 succeeded c2e56b3
💚 Build #32606 succeeded b332ed4

cc @JDKurma

jamiehynds · 2025-10-23T10:31:22Z

it would be worth for sec and o11y to align on the usefuless and intended purpose of the solution category. This can help drive more clarity and easier decision making on the correct labelling.

I personally find the security (or observability) categories useful - they improve discoverability and help users quickly hone in on integrations relevant to their use case, or start broad and drill down (e.g., Security → Endpoint Security). They also allow our field teams to showcase our set of security or o11y quickly and easily. So far, there hasn’t been formal guidance or guardrails on which label should apply to which integrations. There are likely some gaps, but overall the current labels seem in reasonable shape. If certain integrations naturally span both domains (e.g., NetFlow), I don’t think dual categorization is a problem.

jamiehynds · 2025-10-23T10:32:06Z

If miniflux is not a security integration and it never was considered an observability integration then what type of integration is it?

@norrietaylor or @jamiehynds any help with this integration? I have also checked telemetry and we had no trace of this integration to be used by customers for last year or so

I'm not overly familiar with the integration, but its owned by the security team and was developed by @clement-fouque who can probably clarify the intent behind it :)

Remove security category tag from non-security packages

5b28f03

JDKurma self-assigned this Oct 9, 2025

JDKurma added the bugfix Pull request that fixes a bug issue label Oct 9, 2025

JDKurma requested a review from trisch-me October 9, 2025 05:49

JDKurma marked this pull request as ready for review October 9, 2025 15:40

JDKurma requested review from a team as code owners October 9, 2025 15:40

andrewkroh added Team:Obs-InfraObs Observability Infrastructure Monitoring team [elastic/obs-infraobs-integrations] Team:Security-Service Integrations Security Service Integrations team [elastic/security-service-integrations] labels Oct 9, 2025

efd6 reviewed Oct 9, 2025

View reviewed changes

JDKurma added 2 commits October 10, 2025 14:37

Add back 'security' category

e5dd75b

Add back 'security' category

b332ed4

andrewkroh removed Integration:aws_bedrock Amazon Bedrock Integration:azure_openai Azure OpenAI labels Oct 10, 2025

efd6 approved these changes Oct 12, 2025

View reviewed changes

JDKurma added 2 commits October 14, 2025 11:35

Add security category back to manifest.yml

e3168d0

Add security category back to manifest.yml

c2e56b3

JDKurma removed the Integration:azure_app_service Azure App Service label Oct 14, 2025

JDKurma removed the Integration:azure_ai_foundry Azure AI Foundry label Oct 14, 2025

andrewkroh added the Integration:azure_app_service Azure App Service label Oct 14, 2025

JDKurma added 2 commits October 14, 2025 18:19

revert comment change

c92f88d

revert comment change

ec75bb4

JDKurma removed the Integration:azure_app_service Azure App Service label Oct 14, 2025

trisch-me reviewed Oct 16, 2025

View reviewed changes

packages/cisco_meraki_metrics/manifest.yml Show resolved Hide resolved

trisch-me approved these changes Oct 16, 2025

View reviewed changes

trisch-me enabled auto-merge (squash) October 16, 2025 13:25

Merge branch 'main' into remove-miscategorized-security-tags

b918827

trisch-me disabled auto-merge October 16, 2025 13:29

Merge branch 'main' into remove-miscategorized-security-tags

9d42d2b

lalit-satapathy reviewed Oct 17, 2025

View reviewed changes

Add back 'security'

081acaf

JDKurma removed the Integration:cisco_meraki_metrics Cisco Meraki Metrics label Oct 20, 2025

Merge branch 'main' into remove-miscategorized-security-tags

5ccbd87

		# Added security category as Miniflux integration is assigned to security team
		- security

Remove Security Category Tag from Non-Security Packages #15611

Are you sure you want to change the base?

Remove Security Category Tag from Non-Security Packages #15611

Uh oh!

Conversation

JDKurma commented Oct 9, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Proposed commit message

Checklist

Author's Checklist

How to test this PR locally

Related issues

Screenshots

Uh oh!

elasticmachine commented Oct 9, 2025

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

elastic-vault-github-plugin-prod bot commented Oct 10, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

🚀 Benchmarks report

Package miniflux 👍(0) 💚(0) 💔(1)

Package mongodb 👍(0) 💚(0) 💔(1)

Package mysql 👍(1) 💚(0) 💔(2)

Uh oh!

muthu-mps commented Oct 14, 2025

Uh oh!

Mikaayenson commented Oct 14, 2025

Uh oh!

JDKurma commented Oct 14, 2025

Uh oh!

Uh oh!

trisch-me left a comment

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

daniela-elastic commented Oct 17, 2025

Uh oh!

JDKurma commented Oct 20, 2025

Uh oh!

daniela-elastic commented Oct 20, 2025

Uh oh!

trisch-me commented Oct 21, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

elasticmachine commented Oct 21, 2025

💚 Build Succeeded

History

Uh oh!

jamiehynds commented Oct 23, 2025

Uh oh!

jamiehynds commented Oct 23, 2025

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

11 participants

JDKurma commented Oct 9, 2025 •

edited

Loading

elastic-vault-github-plugin-prod bot commented Oct 10, 2025 •

edited

Loading

Package `miniflux` 👍(0) 💚(0) 💔(1)

Package `mongodb` 👍(0) 💚(0) 💔(1)

Package `mysql` 👍(1) 💚(0) 💔(2)

trisch-me commented Oct 21, 2025 •

edited

Loading