[Threat Intel 5/11] Index templates, catalog seeding, and inference features

[stephmilovic]

Summary

Installs Threat Intelligence index templates, semantic-text readiness checks, and fixed-catalog source seeding. The catalog is code-authoritative: missing entries are created, code-owned fields are reconciled, and operator enabled choices are preserved.

Where this sits

#	PR	Depends on	Status
1	#287197 workflow gate correction + fixtures	nothing	✅ merged
2	#287198 contracts, constants, shared libs	nothing	✅ merged
3	#287199 content parsing	#287198	closed
4	#287200 SSRF-guarded HTTP client	#287198	✅ merged
5	#287201 index templates, seeding, inference features ← this PR	#287198, #287200	✅ merged
6	#287202 indicator alias	#287198, #287201	✅ merged
7	#287203 IOC extraction	#287198, #287200	✅ merged
8	#287204 LLM services, routes, source catalog API	#287198, #287200, #287202, #287203	✅ merged
9	#287205 RSS adapter	#287198, #287200, #287203, #287204	✅ merged
10	#287206 remaining adapters, dispatcher, fetch_source step	#287198, #287200, #287203, #287205	✅ merged
11	#287207 promote/scrub tasks and plugin wiring	#287198–#287206	✅ merged
12	#287479 generator fixture article URLs	nothing	✅ merged

#287479 came first in the merge train and is already on main. The numbered series (#287197–#287207) stacks on top in dependency order. #287199 (content parsing) was closed; IOC extraction ships its own section-header classifier.

Scope review follow-up

• Disables legacy catalog rows outside the approved ID set on each boot.
• Exports approved catalog IDs in common constants for downstream routes.
• Treats bulk item failures and incomplete concurrency metadata as bootstrap failures.
• Keeps vendor_api:elastic-security-labs as the stable document ID while reconciling adapter_type to rss.

Product boundary

Operators can only toggle enabled on approved sources. threatIntelSupplyEnabled stays off until direct-index cross-space isolation is hardened.

To test

node scripts/jest --config x-pack/solutions/security/plugins/security_solution/server/threat_intel/jest.config.js setup/seed_default_sources.test.ts setup/bootstrap_threat_intel.test.ts

PR developed with Cursor + Auto

[infra-vault-gh-plugin-prod]

Pinging @elastic/security-threat-hunting (Team:Threat Hunting)

[infra-vault-gh-plugin-prod]

Pinging @elastic/security-solution (Team: SecuritySolution)

[kibanamachine]

Libra found 2 issues.

Generated by Libra

[stephmilovic]

Both addressed, and I took a different approach on the migration one than suggested, so worth a look.

Propagating each migration error would mean changing all 13 signatures and would still miss the failure mode this file worries about most: a migration that runs cleanly but takes a wrong branch and skips its field reports success while leaving the schema just as broken. So the install verifies the outcome instead, re-reading the mappings after every migration and throwing if a migration-owned field is still missing. That gets the retry and unresolved-readiness behaviour asked for, and covers the silent no-op too.

Also carries content.body_is_title_fallback for the title-fallback flag in #287199, so those two want to land together.

[kibanamachine]

💛 Build succeeded, but was flaky

• Buildkite Build
• Commit: a2dff29
• Build duration: 59 mins
• Storybooks Preview

Failed CI Steps

• FTR Configs #72
• Defend Workflows Cypress Tests #5

Metrics [docs]

✅ unchanged

Test Failures

• [job] [logs] FTR Configs #72 / Fleet tasks Agent status change task should not duplicate status-change docs on the next run when last_known_status matches
• [job] [logs] Defend Workflows Cypress Tests #5 / Response console Execute operations: "before all" hook for ""execute --command" - should execute a command" "before all" hook for ""execute --command" - should execute a command"

History

• 💔 Build #495601 failed c7a6246
• 💛 Build #495147 was flaky f42816d
• 💔 Build #495141 failed afd3c51
• 💔 Build #495136 failed afd3c51
• 💚 Build #495068 succeeded b2673de