CODEOWNERS

# Everything outside of packages is maintained by the ecosystem team.
* @elastic/ecosystem
/packages/

# CODEOWNERS file is checked by CI.
/.github/CODEOWNERS

# Package owners below.
# Please keep the list sorted.
/packages/1password @elastic/security-service-integrations
/packages/activemq @elastic/obs-infraobs-integrations
/packages/airflow @elastic/obs-infraobs-integrations
/packages/akamai @elastic/security-service-integrations
/packages/amazon_security_lake @elastic/security-service-integrations
/packages/apache @elastic/obs-infraobs-integrations
/packages/apache_spark @elastic/obs-infraobs-integrations
/packages/apache_tomcat @elastic/obs-infraobs-integrations
/packages/apm @elastic/obs-ds-intake-services
/packages/arista_ngfw @elastic/sec-deployment-and-devices
/packages/atlassian_bitbucket @elastic/security-service-integrations
/packages/atlassian_confluence @elastic/security-service-integrations
/packages/atlassian_jira @elastic/security-service-integrations
/packages/auditd @elastic/sec-linux-platform
/packages/auditd_manager @elastic/sec-linux-platform
/packages/auth0 @elastic/security-service-integrations
/packages/aws @elastic/obs-infraobs-integrations @elastic/obs-ds-hosted-services @elastic/security-service-integrations
/packages/aws/changelog.yml @elastic/obs-ds-hosted-services @elastic/security-service-integrations @elastic/obs-infraobs-integrations
/packages/aws/data_stream/apigateway_logs @elastic/obs-infraobs-integrations
/packages/aws/data_stream/apigateway_metrics @elastic/obs-infraobs-integrations
/packages/aws/data_stream/billing @elastic/obs-infraobs-integrations
/packages/aws/data_stream/cloudfront_logs @elastic/obs-infraobs-integrations
/packages/aws/data_stream/cloudtrail @elastic/obs-infraobs-integrations
/packages/aws/data_stream/cloudwatch_logs @elastic/obs-ds-hosted-services
/packages/aws/data_stream/cloudwatch_metrics @elastic/obs-ds-hosted-services
/packages/aws/data_stream/dynamodb @elastic/obs-infraobs-integrations
/packages/aws/data_stream/ebs @elastic/obs-ds-hosted-services
/packages/aws/data_stream/ec2_logs @elastic/obs-ds-hosted-services
/packages/aws/data_stream/ec2_metrics @elastic/obs-ds-hosted-services
/packages/aws/data_stream/ecs_metrics @elastic/obs-ds-hosted-services
/packages/aws/data_stream/elb_logs @elastic/obs-infraobs-integrations
/packages/aws/data_stream/elb_metrics @elastic/obs-infraobs-integrations
/packages/aws/data_stream/emr_logs @elastic/obs-infraobs-integrations
/packages/aws/data_stream/emr_metrics @elastic/obs-infraobs-integrations
/packages/aws/data_stream/guardduty @elastic/security-service-integrations
/packages/aws/data_stream/kinesis @elastic/obs-infraobs-integrations
/packages/aws/data_stream/lambda @elastic/obs-infraobs-integrations
/packages/aws/data_stream/natgateway @elastic/obs-infraobs-integrations
/packages/aws/data_stream/rds @elastic/obs-infraobs-integrations
/packages/aws/data_stream/redshift @elastic/obs-infraobs-integrations
/packages/aws/data_stream/s3_daily_storage @elastic/obs-ds-hosted-services
/packages/aws/data_stream/s3_request @elastic/obs-ds-hosted-services
/packages/aws/data_stream/s3_storage_lens @elastic/obs-infraobs-integrations
/packages/aws/data_stream/s3access @elastic/obs-ds-hosted-services @elastic/security-service-integrations
/packages/aws/data_stream/securityhub_findings @elastic/security-service-integrations
/packages/aws/data_stream/securityhub_insights @elastic/security-service-integrations
/packages/aws/data_stream/sns @elastic/obs-infraobs-integrations
/packages/aws/data_stream/sqs @elastic/obs-infraobs-integrations
/packages/aws/data_stream/transitgateway @elastic/obs-infraobs-integrations
/packages/aws/data_stream/usage @elastic/obs-infraobs-integrations
/packages/aws/data_stream/vpn @elastic/obs-infraobs-integrations
/packages/aws/kibana @elastic/obs-ds-hosted-services @elastic/kibana-visualizations @elastic/obs-infraobs-integrations
/packages/aws/manifest.yml @elastic/obs-ds-hosted-services @elastic/security-service-integrations @elastic/obs-infraobs-integrations
/packages/aws_bedrock @elastic/security-service-integrations
/packages/aws_logs @elastic/obs-ds-hosted-services
/packages/awsfargate @elastic/obs-infraobs-integrations
/packages/awsfirehose @elastic/obs-ds-hosted-services
/packages/azure @elastic/obs-infraobs-integrations @elastic/obs-ds-hosted-services @elastic/security-service-integrations
/packages/azure/data_stream/activitylogs @elastic/obs-infraobs-integrations
/packages/azure/data_stream/auditlogs @elastic/obs-infraobs-integrations
/packages/azure/data_stream/eventhub @elastic/obs-ds-hosted-services
/packages/azure/data_stream/identity_protection @elastic/obs-infraobs-integrations
/packages/azure/data_stream/platformlogs @elastic/obs-infraobs-integrations
/packages/azure/data_stream/provisioning @elastic/obs-infraobs-integrations
/packages/azure/data_stream/signinlogs @elastic/obs-infraobs-integrations
/packages/azure/data_stream/springcloudlogs @elastic/obs-infraobs-integrations
/packages/azure/data_stream/application_gateway @elastic/security-service-integrations
/packages/azure/data_stream/firewall_logs @elastic/security-service-integrations
/packages/azure_app_service @elastic/obs-infraobs-integrations
/packages/azure_app_service/data_stream/app_service_logs @elastic/obs-infraobs-integrations
/packages/azure_application_insights @elastic/obs-infraobs-integrations
/packages/azure_application_insights/data_stream/app_insights @elastic/obs-infraobs-integrations
/packages/azure_application_insights/data_stream/app_state @elastic/obs-infraobs-integrations
/packages/azure_billing @elastic/obs-infraobs-integrations
/packages/azure_billing/data_stream/billing @elastic/obs-infraobs-integrations
/packages/azure_blob_storage @elastic/security-service-integrations
/packages/azure_frontdoor @elastic/security-service-integrations
/packages/azure_functions @elastic/obs-infraobs-integrations
/packages/azure_functions/data_stream/functionapplogs @elastic/obs-infraobs-integrations
/packages/azure_functions/data_stream/metrics @elastic/obs-infraobs-integrations
/packages/azure_metrics @elastic/obs-ds-hosted-services
/packages/azure_metrics/data_stream/compute_vm @elastic/obs-ds-hosted-services
/packages/azure_metrics/data_stream/compute_vm_scaleset @elastic/obs-ds-hosted-services
/packages/azure_metrics/data_stream/container_instance @elastic/obs-ds-hosted-services
/packages/azure_metrics/data_stream/container_registry @elastic/obs-ds-hosted-services
/packages/azure_metrics/data_stream/container_service @elastic/obs-ds-hosted-services
/packages/azure_metrics/data_stream/database_account @elastic/obs-ds-hosted-services
/packages/azure_metrics/data_stream/monitor @elastic/obs-ds-hosted-services
/packages/azure_metrics/data_stream/storage_account @elastic/obs-ds-hosted-services
/packages/azure_network_watcher_nsg @elastic/security-service-integrations
/packages/azure_network_watcher_vnet @elastic/security-service-integrations
/packages/barracuda @elastic/security-service-integrations
/packages/barracuda_cloudgen_firewall @elastic/security-service-integrations
/packages/bbot @elastic/security-service-integrations
/packages/beaconing @elastic/ml-ui @elastic/sec-applied-ml
/packages/beat @elastic/stack-monitoring
/packages/bitdefender @elastic/security-service-integrations
/packages/bitwarden @elastic/security-service-integrations
/packages/bluecoat @elastic/sec-deployment-and-devices
/packages/box_events @elastic/security-service-integrations
/packages/carbon_black_cloud @elastic/security-service-integrations
/packages/carbonblack_edr @elastic/security-service-integrations
/packages/cassandra @elastic/obs-infraobs-integrations
/packages/cef @elastic/sec-deployment-and-devices
/packages/cel @elastic/security-service-integrations
/packages/ceph @elastic/obs-infraobs-integrations
/packages/checkpoint @elastic/sec-deployment-and-devices
/packages/cisa_kevs @elastic/security-service-integrations
/packages/cisco_aironet @elastic/sec-deployment-and-devices
/packages/cisco_asa @elastic/sec-deployment-and-devices
/packages/cisco_duo @elastic/security-service-integrations
/packages/cisco_ftd @elastic/sec-deployment-and-devices
/packages/cisco_ios @elastic/sec-deployment-and-devices
/packages/cisco_ise @elastic/sec-deployment-and-devices
/packages/cisco_meraki @elastic/security-service-integrations
/packages/cisco_nexus @elastic/sec-deployment-and-devices
/packages/cisco_secure_email_gateway @elastic/sec-deployment-and-devices
/packages/cisco_secure_endpoint @elastic/security-service-integrations
/packages/cisco_umbrella @elastic/security-service-integrations
/packages/citrix_adc @elastic/obs-infraobs-integrations
/packages/citrix_waf @elastic/sec-deployment-and-devices
/packages/cloud_defend @elastic/sec-linux-platform
/packages/cloud_security_posture @elastic/cloud-security-posture
/packages/cloudflare @elastic/security-service-integrations
/packages/cloudflare_logpush @elastic/security-service-integrations
/packages/cockroachdb @elastic/obs-infraobs-integrations
/packages/containerd @elastic/obs-cloudnative-monitoring
/packages/coredns @elastic/obs-infraobs-integrations
/packages/couchbase @elastic/obs-infraobs-integrations
/packages/couchdb @elastic/obs-infraobs-integrations
/packages/cribl @elastic/security-service-integrations
/packages/crowdstrike @elastic/security-service-integrations
/packages/cyberark_pta @elastic/security-service-integrations
/packages/cyberarkpas @elastic/security-service-integrations
/packages/cybereason @elastic/security-service-integrations
/packages/cylance @elastic/security-service-integrations
/packages/darktrace @elastic/security-service-integrations
/packages/ded @elastic/ml-ui @elastic/sec-applied-ml
/packages/dga @elastic/ml-ui @elastic/sec-applied-ml
/packages/docker @elastic/obs-cloudnative-monitoring
/packages/elastic_agent @elastic/elastic-agent
/packages/elastic_package_registry @elastic/ecosystem
/packages/elasticsearch @elastic/stack-monitoring
/packages/enterprisesearch @elastic/stack-monitoring
/packages/entityanalytics_ad @elastic/security-service-integrations
/packages/entityanalytics_entra_id @elastic/security-service-integrations
/packages/entityanalytics_okta @elastic/security-service-integrations
/packages/eset_protect @elastic/security-service-integrations
/packages/etcd @elastic/obs-infraobs-integrations
/packages/f5 @elastic/security-service-integrations
/packages/f5_bigip @elastic/security-service-integrations
/packages/fim @elastic/sec-linux-platform
/packages/fireeye @elastic/security-service-integrations
/packages/fleet_server @elastic/fleet
/packages/forcepoint_web @elastic/security-service-integrations
/packages/forgerock @elastic/security-service-integrations
/packages/fortinet_forticlient @elastic/sec-deployment-and-devices
/packages/fortinet_fortiedr @elastic/sec-deployment-and-devices
/packages/fortinet_fortigate @elastic/sec-deployment-and-devices
/packages/fortinet_fortimail @elastic/sec-deployment-and-devices
/packages/fortinet_fortimanager @elastic/sec-deployment-and-devices
/packages/gcp @elastic/security-service-integrations @elastic/obs-infraobs-integrations @elastic/obs-ds-hosted-services
/packages/gcp/data_stream/audit @elastic/security-service-integrations
/packages/gcp/data_stream/billing @elastic/obs-infraobs-integrations
/packages/gcp/data_stream/cloudrun_metrics @elastic/obs-infraobs-integrations
/packages/gcp/data_stream/cloudsql_mysql @elastic/obs-infraobs-integrations
/packages/gcp/data_stream/cloudsql_postgresql @elastic/obs-infraobs-integrations
/packages/gcp/data_stream/cloudsql_sqlserver @elastic/obs-infraobs-integrations
/packages/gcp/data_stream/compute @elastic/obs-ds-hosted-services
/packages/gcp/data_stream/dataproc @elastic/obs-infraobs-integrations
/packages/gcp/data_stream/dns @elastic/security-service-integrations
/packages/gcp/data_stream/firestore @elastic/obs-infraobs-integrations
/packages/gcp/data_stream/firewall @elastic/security-service-integrations
/packages/gcp/data_stream/gke @elastic/obs-ds-hosted-services
/packages/gcp/data_stream/loadbalancing_logs @elastic/obs-infraobs-integrations
/packages/gcp/data_stream/loadbalancing_metrics @elastic/obs-infraobs-integrations
/packages/gcp/data_stream/pubsub @elastic/obs-ds-hosted-services
/packages/gcp/data_stream/redis @elastic/obs-infraobs-integrations
/packages/gcp/data_stream/storage @elastic/obs-ds-hosted-services
/packages/gcp/data_stream/vpcflow @elastic/security-service-integrations
/packages/gcp_metrics @elastic/obs-ds-hosted-services
/packages/gcp_pubsub @elastic/security-service-integrations
/packages/github @elastic/security-service-integrations
/packages/golang @elastic/obs-infraobs-integrations
/packages/google_cloud_storage @elastic/security-service-integrations
/packages/google_scc @elastic/security-service-integrations
/packages/google_workspace @elastic/security-service-integrations
/packages/hadoop @elastic/obs-infraobs-integrations
/packages/haproxy @elastic/obs-infraobs-integrations
/packages/hashicorp_vault @elastic/sec-deployment-and-devices
/packages/hid_bravura_monitor @elastic/sec-windows-platform
/packages/http_endpoint @elastic/security-service-integrations
/packages/httpjson @elastic/security-service-integrations
/packages/ibmmq @elastic/obs-infraobs-integrations
/packages/iis @elastic/obs-infraobs-integrations
/packages/imperva @elastic/sec-deployment-and-devices
/packages/imperva_cloud_waf @elastic/security-service-integrations
/packages/influxdb @elastic/obs-infraobs-integrations
/packages/infoblox @elastic/security-service-integrations
/packages/infoblox_bloxone_ddi @elastic/security-service-integrations
/packages/infoblox_nios @elastic/security-service-integrations
/packages/iptables @elastic/sec-deployment-and-devices
/packages/istio @elastic/obs-cloudnative-monitoring
/packages/jamf_compliance_reporter @elastic/security-service-integrations
/packages/jolokia_input @elastic/obs-infraobs-integrations
/packages/journald @elastic/elastic-agent-data-plane
/packages/jumpcloud @elastic/security-service-integrations
/packages/juniper_junos @elastic/sec-deployment-and-devices
/packages/juniper_netscreen @elastic/sec-deployment-and-devices
/packages/juniper_srx @elastic/sec-deployment-and-devices
/packages/kafka @elastic/obs-infraobs-integrations
/packages/kafka_log @elastic/obs-infraobs-integrations
/packages/keycloak @elastic/security-service-integrations
/packages/kibana @elastic/stack-monitoring
/packages/kubernetes @elastic/obs-cloudnative-monitoring
/packages/kubernetes/kibana @elastic/obs-cloudnative-monitoring @elastic/kibana-visualizations
/packages/lastpass @elastic/security-service-integrations
/packages/linux @elastic/elastic-agent-data-plane
/packages/lmd @elastic/ml-ui @elastic/sec-applied-ml
/packages/log @elastic/elastic-agent-data-plane
/packages/logstash @elastic/stack-monitoring
/packages/lumos @elastic/security-service-integrations
/packages/lyve_cloud @elastic/security-service-integrations
/packages/m365_defender @elastic/security-service-integrations
/packages/mattermost @elastic/security-service-integrations
/packages/memcached @elastic/obs-infraobs-integrations
/packages/menlo @elastic/security-service-integrations
/packages/microsoft_defender_cloud @elastic/security-service-integrations
/packages/microsoft_defender_endpoint @elastic/security-service-integrations
/packages/microsoft_dhcp @elastic/sec-windows-platform
/packages/microsoft_exchange_online_message_trace @elastic/security-service-integrations
/packages/microsoft_exchange_server @elastic/sec-windows-platform
/packages/microsoft_sqlserver @elastic/obs-infraobs-integrations
/packages/mimecast @elastic/security-service-integrations
/packages/modsecurity @elastic/sec-deployment-and-devices
/packages/mongodb @elastic/obs-infraobs-integrations
/packages/mongodb_atlas @elastic/obs-infraobs-integrations
/packages/mysql @elastic/obs-infraobs-integrations
/packages/mysql_enterprise @elastic/sec-windows-platform
/packages/nagios_xi @elastic/obs-infraobs-integrations
/packages/nats @elastic/obs-infraobs-integrations
/packages/netflow @elastic/sec-deployment-and-devices
/packages/netscout @elastic/sec-deployment-and-devices
/packages/netskope @elastic/security-service-integrations
/packages/network_traffic @elastic/sec-linux-platform
/packages/nginx @elastic/obs-infraobs-integrations
/packages/nginx_ingress_controller @elastic/obs-cloudnative-monitoring
/packages/o365 @elastic/security-service-integrations
/packages/okta @elastic/security-service-integrations
/packages/oracle @elastic/obs-infraobs-integrations
/packages/oracle_weblogic @elastic/obs-infraobs-integrations
/packages/osquery @elastic/sec-deployment-and-devices
/packages/osquery_manager @elastic/security-asset-management
/packages/panw @elastic/sec-deployment-and-devices
/packages/panw_cortex_xdr @elastic/security-service-integrations
/packages/pfsense @elastic/sec-deployment-and-devices
/packages/php_fpm @elastic/obs-infraobs-integrations
/packages/ping_one @elastic/security-service-integrations
/packages/platform_observability @elastic/stack-monitoring
/packages/postgresql @elastic/obs-infraobs-integrations
/packages/pps @elastic/security-service-integrations
/packages/prisma_cloud @elastic/security-service-integrations
/packages/problemchild @elastic/ml-ui @elastic/sec-applied-ml
/packages/prometheus @elastic/obs-infraobs-integrations
/packages/prometheus/data_stream/remote_write @elastic/obs-cloudnative-monitoring
/packages/prometheus_input @elastic/obs-infraobs-integrations
/packages/proofpoint_tap @elastic/security-service-integrations
/packages/pulse_connect_secure @elastic/security-service-integrations
/packages/qualys_vmdr @elastic/security-service-integrations
/packages/qnap_nas @elastic/sec-deployment-and-devices
/packages/rabbitmq @elastic/obs-infraobs-integrations
/packages/radware @elastic/sec-deployment-and-devices
/packages/rapid7_insightvm @elastic/security-service-integrations
/packages/redis @elastic/obs-infraobs-integrations
/packages/redisenterprise @elastic/obs-infraobs-integrations
/packages/salesforce @elastic/obs-infraobs-integrations
/packages/santa @elastic/security-service-integrations
/packages/security_detection_engine @elastic/protections
/packages/sentinel_one @elastic/security-service-integrations
/packages/sentinel_one_cloud_funnel @elastic/security-service-integrations
/packages/slack @elastic/security-service-integrations
/packages/snort @elastic/sec-deployment-and-devices
/packages/snyk @elastic/security-service-integrations
/packages/sonicwall_firewall @elastic/sec-deployment-and-devices
/packages/sophos @elastic/sec-deployment-and-devices
/packages/sophos_central @elastic/security-service-integrations
/packages/spring_boot @elastic/obs-infraobs-integrations
/packages/sql_input @elastic/obs-infraobs-integrations
/packages/squid @elastic/sec-deployment-and-devices
/packages/stan @elastic/obs-infraobs-integrations
/packages/statsd_input @elastic/obs-infraobs-integrations
/packages/suricata @elastic/sec-deployment-and-devices
/packages/symantec_edr_cloud @elastic/security-service-integrations
/packages/symantec_endpoint @elastic/security-service-integrations
/packages/symantec_endpoint_security @elastic/security-service-integrations
/packages/synthetics @elastic/obs-ux-infra_services-team
/packages/synthetics_dashboards @elastic/obs-ux-infra_services-team
/packages/sysmon_linux @elastic/sec-linux-platform
/packages/system @elastic/obs-infraobs-integrations
/packages/system/changelog.yml @elastic/obs-infraobs-integrations @elastic/sec-linux-platform @elastic/sec-windows-platform
/packages/system/data_stream/auth @elastic/sec-windows-platform
/packages/system/data_stream/security @elastic/sec-linux-platform @elastic/sec-windows-platform
/packages/system/manifest.yml @elastic/obs-infraobs-integrations @elastic/sec-linux-platform @elastic/sec-windows-platform
/packages/system_audit @elastic/sec-linux-platform
/packages/tanium @elastic/security-service-integrations
/packages/tcp @elastic/sec-deployment-and-devices
/packages/tenable_io @elastic/security-service-integrations
/packages/tenable_sc @elastic/security-service-integrations
/packages/thycotic_ss @elastic/security-service-integrations
/packages/ti_abusech @elastic/security-service-integrations
/packages/ti_anomali @elastic/security-service-integrations
/packages/ti_cif3 @elastic/security-service-integrations
/packages/ti_crowdstrike @elastic/security-service-integrations
/packages/ti_cybersixgill @elastic/security-service-integrations
/packages/ti_eclecticiq @elastic/security-service-integrations
/packages/ti_eset @elastic/security-service-integrations
/packages/ti_maltiverse @elastic/security-service-integrations
/packages/ti_mandiant_advantage @elastic/security-service-integrations
/packages/ti_misp @elastic/security-service-integrations
/packages/ti_opencti @elastic/security-service-integrations
/packages/ti_otx @elastic/security-service-integrations
/packages/ti_rapid7_threat_command @elastic/security-service-integrations
/packages/ti_recordedfuture @elastic/security-service-integrations
/packages/ti_threatconnect @elastic/security-service-integrations
/packages/ti_threatq @elastic/security-service-integrations
/packages/ti_util @elastic/security-service-integrations
/packages/tines @elastic/security-service-integrations
/packages/tomcat @elastic/obs-infraobs-integrations
/packages/traefik @elastic/obs-infraobs-integrations
/packages/trellix_edr_cloud @elastic/security-service-integrations
/packages/trellix_epo_cloud @elastic/security-service-integrations
/packages/trend_micro_vision_one @elastic/security-service-integrations
/packages/trendmicro @elastic/security-service-integrations
/packages/udp @elastic/sec-deployment-and-devices
/packages/universal_profiling_agent @elastic/profiling
/packages/universal_profiling_collector @elastic/obs-ds-intake-services
/packages/universal_profiling_symbolizer @elastic/obs-ds-intake-services
/packages/vectra_detect @elastic/security-service-integrations
/packages/vsphere @elastic/obs-infraobs-integrations
/packages/websphere_application_server @elastic/obs-infraobs-integrations
/packages/windows @elastic/elastic-agent-data-plane @elastic/sec-windows-platform
/packages/windows/data_stream/applocker_exe_and_dll @elastic/sec-windows-platform
/packages/windows/data_stream/applocker_msi_and_script @elastic/sec-windows-platform
/packages/windows/data_stream/applocker_packaged_app_deployment @elastic/sec-windows-platform
/packages/windows/data_stream/applocker_packaged_app_execution @elastic/sec-windows-platform
/packages/windows/data_stream/forwarded @elastic/sec-windows-platform
/packages/windows/data_stream/perfmon @elastic/elastic-agent-data-plane
/packages/windows/data_stream/powershell @elastic/sec-windows-platform
/packages/windows/data_stream/powershell_operational @elastic/sec-windows-platform
/packages/windows/data_stream/service @elastic/elastic-agent-data-plane
/packages/windows/data_stream/sysmon_operational @elastic/sec-windows-platform
/packages/windows_etw @elastic/sec-windows-platform
/packages/winlog @elastic/sec-windows-platform
/packages/wiz @elastic/security-service-integrations
/packages/zeek @elastic/sec-deployment-and-devices
/packages/zerofox @elastic/security-service-integrations
/packages/zeronetworks @elastic/security-service-integrations
/packages/zookeeper @elastic/obs-infraobs-integrations
/packages/zoom @elastic/security-service-integrations
/packages/zscaler_zia @elastic/security-service-integrations
/packages/zscaler_zpa @elastic/security-service-integrations
/packages/jamf_protect @elastic/security-service-integrations