elastic / elastic/integrations

Single-stream integrations have `enabled: false` set on their only stream

Open
#18,157 2 comments 0 reactions 0 assignees View on GitHub
Dominant language
Handlebars
Stars
333
Forks
647
Avg merge
2d 17h
Merged PRs (30d)
225

Description

## Description:

The following integrations have `enabled: false` set on their single stream in their manifest,
which causes them to be installed in a disabled state by default:

- CISA Known Exploited Vulnerabilities (cisa_kevs)
- Cisco Umbrella (cisco_umbrella)
- Digital Guardian (digital_guardian)
- Active Directory Entity Analytics (entityanalytics_ad)
- Okta Entity Analytics (entityanalytics_okta)
- Google SecOps (google_secops)
- Lyve Cloud (lyve_cloud)
- Palo Alto Prisma Access (prisma_access)
- Proofpoint ITM (proofpoint_itm)

This is compounded by a [Kibana Bug](https://github.com/elastic/kibana/issues/260500) where the stream toggle is hidden for single-stream integrations, leaving users with no UI control to re-enable. Unless there's an intentional reason for these to default to disabled, the `enabled: false` should be removed.

cc @elastic/security-service-integrations

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.