Abuse.ch API key required but no option in integration

Elastic Stack Elastic Agent
1

Hello

It appears that Abuse.ch can now block the Threat intel integration because of rate limiting restrictions. If we were to use API key however there is no option to place that under the integration since they require you to use separate HTTP header (ex. header "Auth-Key: YOUR-AUTH-KEY-HERE")

Is there a way to bypass this limitation currently.

[root@elastic mnt]# elastic-agent status
┌─ fleet
│  └─ status: (HEALTHY) Connected
└─ elastic-agent
   ├─ status: (DEGRADED) 1 or more components/units in a degraded state
   └─ cel-default
      ├─ status: (HEALTHY) Healthy: communicating with pid '679465'
      └─ cel-default-cel-ti_abusech-6e53194d-dafd-4232-8a16-67fb2f5bfbbf
         └─ status: (DEGRADED) single event error object returned by evaluation: {"error":{"code":"402","id":"402 Payment Required","message":"POST:{\n    \"query_status\": \"ratelimited\",\n    \"msg\": \"Your request has been rate-limited. Please visit https:\\/\\/abuse.ch\\/rate-limit\\/ for more information.\"\n}"}}
2

I have the same

3

Abuse.CH changed their API and now some endpoints require an Auth-Key to not be rate limited.

The integration is not read for that, so it won't work until it is fixed.

There is already an open issue on Github to fix it: [AbuseCH]: Add Auth-Key field · Issue #13237 · elastic/integrations · GitHub