[ti_threatconnect] Add agentless deployment

[moxarth-rathod]

Proposed commit message

ti_threatconnect: add agentless support and update kibana version constraint

Checklist

• I have reviewed tips for building integrations and this pull request is aligned with them.
• I have verified that all data streams collect metrics or logs.
• I have added an entry to my package's changelog.yml file.
• I have verified that Kibana version constraints are current according to guidelines.
• I have verified that any added dashboard complies with Kibana's Dashboard good practices

How to test this PR locally

• Clone integrations repo.
• Install the elastic package locally.
• Start the elastic stack using the elastic package.
• Move to integrations/packages/ti_threatconnect directory.
• Run the following command to run tests.

elastic-package test -v

Related issues

• Closes [ti_threatconnect] Add Agentless Deployment Support #19594

[infra-vault-gh-plugin-prod]

Pinging @elastic/security-service-integrations (Team:Security-Service Integrations)

[github-actions]

✅ Elastic Docs Style Checker (Vale)

No issues found on modified lines!

---

The Vale linter checks documentation changes against the Elastic Docs style guide. To use Vale locally or report issues, refer to Elastic style guide for Vale.

[elastic-vault-github-plugin-prod]

Changelog link mismatch — expected https://github.com/elastic/integrations/pull/19642 in the following file(s):

• packages/ti_threatconnect/changelog.yml

Tip

If expected, add the changelog-link-check:skip label to skip this check. Or, if an issue link was intended, use .../issues/<n> instead.

View Buildkite build
@moxarth-rathod

[elasticmachine]

💔 Build Failed

• Buildkite Build
• Commit: 511a8b6

Failed CI Steps

• 📜 Check changelog PR links

History

cc @moxarth-rathod

[elastic-vault-github-plugin-prod]

🚀 Benchmarks report

To see the full report comment with /test benchmark fullreport

[vera-review-bot]

👀 I have started reviewing the PR

[vera-review-bot]

🟡 MEDIUM changelog.yml:6

Changelog entry links to placeholder PR

The new 2.2.0 changelog entry sets link: https://github.com/elastic/integrations/pull/1, which points to an unrelated placeholder PR rather than this change. This PR is #​19642 (per the PR metadata). A wrong changelog link breaks the changelog-to-PR traceability that the entry is meant to provide.

Recommendation:

Point the link at the PR that introduces this change:

- version: "2.2.0"
  changes:
    - description: Enable Agentless deployment.
      type: enhancement
      link: https://github.com/elastic/integrations/pull/19642

---

🤖 AI-Generated Review | Vera Review Bot | 📚 Knowledge base: integration-skills

⚠️ Automated review — verify suggestions before applying.