Remove Security Category Tag from Non-Security Packages #15611

JDKurma · 2025-10-09T05:46:49Z

Proposed commit message

The following packages are categorized as security despite not being semantically related to security nor having security related datastreams:

[
  "cisco_meraki_metrics",
  "miniflux",
  "mongodb",
  "mysql"
]

Datastreams:

[
  {
    "package": "cisco_meraki_metrics",
    "datastream": "cisco_meraki_metrics.device_health"
  },
  {
    "package": "miniflux",
    "datastream": "miniflux.feed_entry"
  },
  {
    "package": "mongodb",
    "datastream": "mongodb.collstats"
  },
  {
    "package": "mongodb",
    "datastream": "mongodb.dbstats"
  },
  {
    "package": "mongodb",
    "datastream": "mongodb.log"
  },
  {
    "package": "mongodb",
    "datastream": "mongodb.metrics"
  },
  {
    "package": "mongodb",
    "datastream": "mongodb.replstatus"
  },
  {
    "package": "mongodb",
    "datastream": "mongodb.status"
  },
  {
    "package": "mysql",
    "datastream": "mysql.error"
  },
  {
    "package": "mysql",
    "datastream": "mysql.galera_status"
  },
  {
    "package": "mysql",
    "datastream": "mysql.performance"
  },
  {
    "package": "mysql",
    "datastream": "mysql.replica_status"
  },
  {
    "package": "mysql",
    "datastream": "mysql.slowlog"
  },
  {
    "package": "mysql",
    "datastream": "mysql.status"
  }
]

I've removed the security tag for the above mentioned packages to accurately categorize them.

Checklist

I have reviewed tips for building integrations and this pull request is aligned with them.
I have verified that all data streams collect metrics or logs.
I have added an entry to my package's changelog.yml file.
I have verified that Kibana version constraints are current according to guidelines.
I have verified that any added dashboard complies with Kibana's Dashboard good practices

Author's Checklist

[ ]

How to test this PR locally

Related issues

[Enhancement] Update categories for packages #14571

Screenshots

elasticmachine · 2025-10-09T16:00:39Z

Pinging @elastic/security-service-integrations (Team:Security-Service Integrations)

efd6 · 2025-10-09T22:58:22Z

packages/miniflux/manifest.yml

-  # Added security category as Miniflux integration is assigned to security team
-  - security


@clement-fouque Do you recall why this was added as a security integration?

I think we had a discussion but I don't remember why we added it. We can remove it.

It is owned by security team, has it no security use case?

efd6 · 2025-10-09T22:59:13Z

packages/aws_bedrock/manifest.yml

  - aws
  - cloud
  - observability
-  - security


@Mikaayenson What's your view on whether the bedrock integration is a security product?

We do have prebuilt security detection rules that leverage this integration.

This is the same case for azure_openai.

Note: We have some PRs in the work to further codify security related genai fields. See:

Stage 0: [RFC] Stage 0: Add additional GenAI fields ecs#2519

Stage 1: [RFC 0052] Stage 1: Update GenAI fields ecs#2525

Stage 2: [RFC 0052] Stage 2: Update additional GenAI fields ecs#2532

Reverted the changes for those!

elastic-vault-github-plugin-prod · 2025-10-10T20:22:51Z

🚀 Benchmarks report

To see the full report comment with /test benchmark fullreport

muthu-mps · 2025-10-14T05:07:03Z

azure_app_service logs include the AppServiceIPSecAuditLogs, AppServiceAuditLogs and AppServiceHTTPLogs categories. This integration can be tagged with security category.
Azure AI Foundry is an enhanced version of Azure OpenAI that currently enables monitoring of both third-party models and Azure OpenAI models. @Mikaayenson - Do you think the threat detection rule implementation can be done for AI Foundry similar to Azure OpenAI? If yes, Then this integration can get tagged with security category similar to Azure OpenAI.

Mikaayenson · 2025-10-14T11:01:32Z

azure_app_service logs include the AppServiceIPSecAuditLogs, AppServiceAuditLogs and AppServiceHTTPLogs categories. This integration can be tagged with security category.

Azure AI Foundry is an enhanced version of Azure OpenAI that currently enables monitoring of both third-party models and Azure OpenAI models. @Mikaayenson - Do you think the threat detection rule implementation can be done for AI Foundry similar to Azure OpenAI? If yes, Then this integration can get tagged with security category similar to Azure OpenAI.

Yes, we just do not yet have any prebuilt rules for this integration. And if we ever get a gemini integration that would too.

JDKurma · 2025-10-14T16:53:28Z

@muthu-mps removed both!

trisch-me · 2025-10-16T13:24:10Z

packages/cisco_meraki_metrics/manifest.yml

 categories:
  - network
  - observability
-  - security


why this was removed? It was added a year ago so I’m concerned if this is a correct approach.

It is fine to assume that the metrics one is purely o11y usecase?

trisch-me

lgtm apart from 1 change

elasticmachine · 2025-10-16T17:49:50Z

💚 Build Succeeded

Buildkite Build
Commit: 9d42d2b

History

💚 Build #32787 succeeded b918827
💚 Build #32735 succeeded ec75bb4
💚 Build #32723 succeeded c2e56b3
💚 Build #32606 succeeded b332ed4
💚 Build #32544 succeeded 5b28f03

cc @JDKurma

lalit-satapathy · 2025-10-17T03:36:11Z

packages/miniflux/manifest.yml

-  # Added security category as Miniflux integration is assigned to security team
-  - security


It is owned by security team, has it no security use case?

lalit-satapathy · 2025-10-17T03:36:23Z

packages/mongodb/manifest.yml

-  # Added database_security category as it collects database logs and metrics including collection statistics, database statistics, and replication status
-  - database_security
-  # Added global security category as this integration collects security-relevant data
-  - security


lalit-satapathy · 2025-10-17T03:36:30Z

packages/mysql/manifest.yml

-  # Added database_security category as it collects error logs, slow query logs, and replication status metrics that are relevant for database security monitoring
-  - database_security
-  # Added global security category as this integration collects security-relevant data
-  - security


lalit-satapathy · 2025-10-17T03:36:57Z

packages/cisco_meraki_metrics/manifest.yml

 categories:
  - network
  - observability
-  - security


It is fine to assume that the metrics one is purely o11y usecase?

daniela-elastic · 2025-10-17T11:55:01Z

CC @jamiehynds There was a whole re-categorization effort done recently to more effectively label the various use cases for each integration (see PR). As a result, additional solution categories were added to some integrations.

The bigger picture:
A decision of how we label an integration (o11y or security) is how customers ultimately use it. Today there are integrations that are effectively used for both but are mis-labled as only catering to one use case. For example, recently speaking with field team revealed that the Netflow integration is being used by customers and sold as a through-and-through observability integration, however it is not labeled as such (see manifest file)

Next steps:
@jamiehynds it would be worth for sec and o11y to align on the usefuless and intended purpose of the solution category. This can help drive more clarity and easier decision making on the correct labelling.

Remove security category tag from non-security packages

5b28f03

JDKurma self-assigned this Oct 9, 2025

JDKurma added the bugfix Pull request that fixes a bug issue label Oct 9, 2025

JDKurma requested a review from trisch-me October 9, 2025 05:49

JDKurma marked this pull request as ready for review October 9, 2025 15:40

JDKurma requested review from a team as code owners October 9, 2025 15:40

andrewkroh added Team:Obs-InfraObs Observability Infrastructure Monitoring team [elastic/obs-infraobs-integrations] Team:Security-Service Integrations Security Service Integrations team [elastic/security-service-integrations] labels Oct 9, 2025

efd6 reviewed Oct 9, 2025

View reviewed changes

JDKurma added 2 commits October 10, 2025 14:37

Add back 'security' category

e5dd75b

Add back 'security' category

b332ed4

andrewkroh removed Integration:aws_bedrock Amazon Bedrock Integration:azure_openai Azure OpenAI labels Oct 10, 2025

efd6 approved these changes Oct 12, 2025

View reviewed changes

JDKurma added 2 commits October 14, 2025 11:35

Add security category back to manifest.yml

e3168d0

Add security category back to manifest.yml

c2e56b3

JDKurma removed the Integration:azure_app_service Azure App Service label Oct 14, 2025

JDKurma removed the Integration:azure_ai_foundry Azure AI Foundry label Oct 14, 2025

andrewkroh added the Integration:azure_app_service Azure App Service label Oct 14, 2025

JDKurma added 2 commits October 14, 2025 18:19

revert comment change

c92f88d

revert comment change

ec75bb4

JDKurma removed the Integration:azure_app_service Azure App Service label Oct 14, 2025

trisch-me reviewed Oct 16, 2025

View reviewed changes

trisch-me approved these changes Oct 16, 2025

View reviewed changes

trisch-me enabled auto-merge (squash) October 16, 2025 13:25

Merge branch 'main' into remove-miscategorized-security-tags

b918827

trisch-me disabled auto-merge October 16, 2025 13:29

Merge branch 'main' into remove-miscategorized-security-tags

9d42d2b

lalit-satapathy reviewed Oct 17, 2025

View reviewed changes

		# Added security category as Miniflux integration is assigned to security team
		- security

Remove Security Category Tag from Non-Security Packages #15611

Are you sure you want to change the base?

Remove Security Category Tag from Non-Security Packages #15611

Uh oh!

Conversation

JDKurma commented Oct 9, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Proposed commit message

Checklist

Author's Checklist

How to test this PR locally

Related issues

Screenshots

Uh oh!

elasticmachine commented Oct 9, 2025

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

elastic-vault-github-plugin-prod bot commented Oct 10, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

🚀 Benchmarks report

Uh oh!

muthu-mps commented Oct 14, 2025

Uh oh!

Mikaayenson commented Oct 14, 2025

Uh oh!

JDKurma commented Oct 14, 2025

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

trisch-me left a comment

Choose a reason for hiding this comment

Uh oh!

elasticmachine commented Oct 16, 2025

💚 Build Succeeded

History

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

daniela-elastic commented Oct 17, 2025

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

10 participants

JDKurma commented Oct 9, 2025 •

edited

Loading

elastic-vault-github-plugin-prod bot commented Oct 10, 2025 •

edited

Loading