[ti_google_threat_intelligence] Clarify "enrichment" in the README

[chrisberkhout]

Proposed commit message

ti_google_threat_intelligence: rename detection rules section to avoid confusion with data enrichment

The heading "Enrichment with Detection Rules" led a customer to
expect automatic data enrichment of their existing indices. The
integration actually ingests threat indicators separately; prebuilt
SIEM detection rules then match those indicators against other data
sources and fire alerts.

Rename the section to "Customizing Detection Rules" and reword
surrounding text to remove ambiguity between this detection-rule
workflow and the unrelated ECS event.kind "enrichment" value that
also appears in the integration's data.

Checklist

• I have reviewed tips for building integrations and this pull request is aligned with them.
• I have verified that all data streams collect metrics or logs.
• I have added an entry to my package's changelog.yml file.
• I have verified that Kibana version constraints are current according to guidelines.
• I have verified that any added dashboard complies with Kibana's Dashboard good practices

[infra-vault-gh-plugin-prod]

Pinging @elastic/security-service-integrations (Team:Security-Service Integrations)

[github-actions]

✅ Elastic Docs Style Checker (Vale)

No issues found on modified lines!

---

The Vale linter checks documentation changes against the Elastic Docs style guide. To use Vale locally or report issues, refer to Elastic style guide for Vale.

[efd6]

I'm not sure what "enhanced" is here since it doesn't appear in the original documents.

[chrisberkhout]

I meant to say "enrichment". Updated the changelog and proposed commit message.

[elastic-vault-github-plugin-prod]

🚀 Benchmarks report

To see the full report comment with /test benchmark fullreport

[elastic-vault-github-plugin-prod]

✅ All changelog entries have the correct PR link.

[elasticmachine]

💔 Build Failed

• Buildkite Build
• Commit: 07eb599

Failed CI Steps

• Check integrations ti_google_threat_intelligence

History

• 💚 Build #44318 succeeded 00db59e
• 💚 Build #44233 succeeded b4abfd6

cc @chrisberkhout

[github-actions]

TL;DR

Buildkite failed in docs lint because the package README is stale: the template was updated, but the rendered file was not regenerated and committed. Regenerate the package docs and commit the updated docs/README.md.

Remediation

• Run elastic-package build for packages/ti_google_threat_intelligence and commit the regenerated packages/ti_google_threat_intelligence/docs/README.md.
• Re-run the package check (.buildkite/scripts/test_one_package.sh packages/ti_google_threat_intelligence origin/main 07eb59977618429c50fbe1989091c23b731e2ebd) to confirm lint passes.

Investigation details

Root Cause

The failing step is the README up-to-date check during package lint. In commit 07eb59977618429c50fbe1989091c23b731e2ebd, _dev/build/docs/README.md was edited, but the generated output in docs/README.md still contained the old text, so elastic-package detected a mismatch.

Relevant lines at the failing commit:

• packages/ti_google_threat_intelligence/_dev/build/docs/README.md:162 uses "processed"
• packages/ti_google_threat_intelligence/docs/README.md:162 still uses "procesed"

Evidence

• Build: https://buildkite.com/elastic/integrations/builds/44337
• Job/step: Check integrations ti_google_threat_intelligence
• Key log excerpt:

README.md is outdated. Rebuild the package with 'elastic-package build'
@@ -161,3 +161,3 @@
-2. If GTI information is ingested and procesed by a transform, ...
+2. If GTI information is ingested and processed by a transform, ...
Error: checking package failed: checking readme files are up-to-date failed: files do not match

Verification

• Not run locally in this workflow; conclusion is from Buildkite failure log plus repository content at commit 07eb59977618429c50fbe1989091c23b731e2ebd.

Follow-up

After committing the regenerated docs file, this failure should clear without code changes outside documentation.

Note

🔒 Integrity filter blocked 2 items

The following items were blocked because they don't meet the GitHub integrity level.

• [ti_google_threat_intelligence] Clarify "enrichment" in the README #19411 pull_request_read: has lower integrity than agent requires. The agent cannot read data with integrity below "approved".
• #19411 pull_request_read: has lower integrity than agent requires. The agent cannot read data with integrity below "approved".

To allow these resources, lower min-integrity in your GitHub frontmatter:

tools:
  github:
    min-integrity: approved  # merged | approved | unapproved | none

---

What is this? | From workflow: PR Buildkite Detective

Give us feedback! React with 🚀 if perfect, 👍 if helpful, 👎 if not.