Motivation
When integrations are hosted and managed using the agentless deployment_mode, some special security handling is invoked. From a security perspective, we treat the deployment as if it could run arbitrary malicious code and be controlled by the user. Its network is isolated, ingress is disallowed and only specific egress is allowed.
This means that many inputs won't be user-useable. These inputs include tcp, udp, winlog, http endpoint, and filestream.
Some integrations like crowdstrike.fdrr have datastreams that support multiple input types. If we use the agentless deployment mode for this integration S3 will be valid, but filestream will not.
Questions
- Should the configurations for these input types be hidden when deployment_mode agentless is enabled?
- Should there be an explicit option to hide invalid variables/configurations on agentless deployments?
Motivation
When integrations are hosted and managed using the agentless deployment_mode, some special security handling is invoked. From a security perspective, we treat the deployment as if it could run arbitrary malicious code and be controlled by the user. Its network is isolated, ingress is disallowed and only specific egress is allowed.
This means that many inputs won't be user-useable. These inputs include tcp, udp, winlog, http endpoint, and filestream.
Some integrations like crowdstrike.fdrr have datastreams that support multiple input types. If we use the agentless deployment mode for this integration S3 will be valid, but filestream will not.
Questions