diff --git a/CHANGELOG.next.asciidoc b/CHANGELOG.next.asciidoc
index aecead61b01..74a66ef3c23 100644
--- a/CHANGELOG.next.asciidoc
+++ b/CHANGELOG.next.asciidoc
@@ -302,6 +302,7 @@ is collected by it.
 
 *Filebeat*
 
+- Deprecate rsa2elk Filebeat modules. {issue}36125[36125] {pull}36887[36887]
 
 *Heartbeat*
 
diff --git a/filebeat/docs/howto/howto.asciidoc b/filebeat/docs/howto/howto.asciidoc
index 7d18cd48225..7b9a3cffa03 100644
--- a/filebeat/docs/howto/howto.asciidoc
+++ b/filebeat/docs/howto/howto.asciidoc
@@ -16,6 +16,7 @@ Learn how to perform common {beatname_uc} configuration tasks.
 * <<using-environ-vars>>
 * <<yaml-tips>>
 * <<migrate-to-filestream>>
+* <<migrate-from-deprecated-module>>
 
 
 --
@@ -46,4 +47,5 @@ include::{libbeat-dir}/yaml.asciidoc[]
 
 include::migrate-to-filestream.asciidoc[]
 
+include::migrate-from-deprecated-module.asciidoc[]
 
diff --git a/filebeat/docs/howto/migrate-from-deprecated-module.asciidoc b/filebeat/docs/howto/migrate-from-deprecated-module.asciidoc
new file mode 100644
index 00000000000..fd163353f92
--- /dev/null
+++ b/filebeat/docs/howto/migrate-from-deprecated-module.asciidoc
@@ -0,0 +1,30 @@
+[[migrate-from-deprecated-module]]
+== Migrating from a Deprecated Filebeat Module
+
+If a Filebeat module has been deprecated, there are a few options available for
+a path forward:
+
+1. Migrate to an Elastic integration, if available. The deprecation notice will
+link to an appropriate integration, if one exists.
+
+2. https://www.elastic.co/guide/en/fleet/current/migrate-beats-to-agent.html[Migrate to Elastic Agent]
+for ingesting logs. If a specific integration for the vendor/product does not
+exist, then one of the custom integrations can be used for ingesting events. A
+https://www.elastic.co/guide/en/fleet/current/data-streams-pipeline-tutorial.html[custom pipeline]
+may also be attached to the integration for further processing.
+    - https://docs.elastic.co/integrations/cel[CEL Custom API] - Collect events from an API using CEL (Common Expression Language)
+    - https://docs.elastic.co/integrations/httpjson[Custom API] - Collect events from an API using the HTTPJSON input
+    - https://docs.elastic.co/integrations/gcp_pubsub[Custom Google Pub/Sub] - Collect events from Google Pub/Sub topics
+    - https://docs.elastic.co/integrations/http_endpoint[Custom HTTP Endpoint] - Collect events from a listening HTTP port
+    - https://docs.elastic.co/integrations/journald[Custom Journald] - Collect events from journald
+    - https://docs.elastic.co/integrations/kafka_log[Custom Kafka] - Collect events from a Kafka topic
+    - https://docs.elastic.co/integrations/log[Custom Logs] - Collect events from files
+    - https://docs.elastic.co/integrations/tcp[Custom TCP] - Collect events from a listening TCP port
+    - https://docs.elastic.co/integrations/udp[Custom UDP] - Collect events from a listening UDP port
+    - https://docs.elastic.co/integrations/winlog[Custom Windows Event] - Collect events from a Windows Event Log channel
+
+3. Migrate to a different Filebeat module. In some cases, a Filebeat module may
+be superseded by a new module. The deprecation notice will link to an appropriate
+module, if one exists.
+
+4. Use a custom Filebeat input, processors, and ingest pipeline (if necessary).
diff --git a/filebeat/docs/modules/barracuda.asciidoc b/filebeat/docs/modules/barracuda.asciidoc
index 4b9f65fdfaf..958c9a4444b 100644
--- a/filebeat/docs/modules/barracuda.asciidoc
+++ b/filebeat/docs/modules/barracuda.asciidoc
@@ -12,6 +12,8 @@ This file is generated! See scripts/docs_collector.py
 
 == Barracuda module
 
+deprecated::[8.12.0,"This module is deprecated. Use the https://docs.elastic.co/integrations/barracuda[Barracuda Web Application Firewall] Elastic integration instead."]
+
 experimental[]
 
 include::{libbeat-dir}/shared/integration-link.asciidoc[]
diff --git a/filebeat/docs/modules/bluecoat.asciidoc b/filebeat/docs/modules/bluecoat.asciidoc
index 843ef578aa3..c9dc391c6b4 100644
--- a/filebeat/docs/modules/bluecoat.asciidoc
+++ b/filebeat/docs/modules/bluecoat.asciidoc
@@ -12,6 +12,8 @@ This file is generated! See scripts/docs_collector.py
 
 == Bluecoat module
 
+deprecated::[8.12.0,"This module is deprecated. See <<migrate-from-deprecated-module>> for migration options."]
+
 experimental[]
 
 include::{libbeat-dir}/shared/integration-link.asciidoc[]
diff --git a/filebeat/docs/modules/cisco.asciidoc b/filebeat/docs/modules/cisco.asciidoc
index da25fb38c05..ca094907b98 100644
--- a/filebeat/docs/modules/cisco.asciidoc
+++ b/filebeat/docs/modules/cisco.asciidoc
@@ -281,6 +281,8 @@ include::../include/timezone-support.asciidoc[]
 [float]
 ==== `nexus` fileset settings
 
+deprecated::[8.12.0,"This fileset is deprecated. Use the https://docs.elastic.co/integrations/cisco_nexus[Cisco Nexus] Elastic integration instead."]
+
 experimental[]
 
 NOTE: This was converted from RSA NetWitness log parser XML "cisconxos" device revision 134.
@@ -326,6 +328,8 @@ will be found under `rsa.raw`. The default is false.
 [float]
 ==== `meraki` fileset settings
 
+deprecated::[8.12.0,"This fileset is deprecated. Use the https://docs.elastic.co/integrations/cisco_meraki[Cisco Meraki] Elastic integration instead."]
+
 experimental[]
 
 NOTE: This was converted from RSA NetWitness log parser XML "ciscomeraki" device revision 118.
diff --git a/filebeat/docs/modules/cylance.asciidoc b/filebeat/docs/modules/cylance.asciidoc
index ecb87052881..8eb9b356ce7 100644
--- a/filebeat/docs/modules/cylance.asciidoc
+++ b/filebeat/docs/modules/cylance.asciidoc
@@ -12,6 +12,8 @@ This file is generated! See scripts/docs_collector.py
 
 == Cylance module
 
+deprecated::[8.12.0,"This module is deprecated. See <<migrate-from-deprecated-module>> for migration options."]
+
 experimental[]
 
 include::{libbeat-dir}/shared/integration-link.asciidoc[]
diff --git a/filebeat/docs/modules/f5.asciidoc b/filebeat/docs/modules/f5.asciidoc
index 366587eb675..d8a5f50d784 100644
--- a/filebeat/docs/modules/f5.asciidoc
+++ b/filebeat/docs/modules/f5.asciidoc
@@ -12,6 +12,8 @@ This file is generated! See scripts/docs_collector.py
 
 == F5 module
 
+deprecated::[8.12.0,"This module is deprecated. Use the https://docs.elastic.co/integrations/f5_bigip[F5 BIG-IP] Elastic integration instead."]
+
 experimental[]
 
 include::{libbeat-dir}/shared/integration-link.asciidoc[]
diff --git a/filebeat/docs/modules/fortinet.asciidoc b/filebeat/docs/modules/fortinet.asciidoc
index 3149c062ae2..f6575c7db65 100644
--- a/filebeat/docs/modules/fortinet.asciidoc
+++ b/filebeat/docs/modules/fortinet.asciidoc
@@ -81,6 +81,8 @@ events. Defaults to `[fortinet-firewall, forwarded]`.
 [float]
 ==== `clientendpoint` fileset settings
 
+deprecated::[8.12.0,"This fileset is deprecated. Use the https://docs.elastic.co/integrations/fortinet_forticlient[Fortinet FortiClient Logs] Elastic integration instead."]
+
 experimental[]
 
 NOTE: This was converted from RSA NetWitness log parser XML "forticlientendpoint" device revision 0.
@@ -126,6 +128,8 @@ will be found under `rsa.raw`. The default is false.
 [float]
 ==== `fortimail` fileset settings
 
+deprecated::[8.12.0,"This fileset is deprecated. Use the https://docs.elastic.co/integrations/fortinet_fortimail[Fortinet FortiMail] Elastic integration instead."]
+
 experimental[]
 
 NOTE: This was converted from RSA NetWitness log parser XML "fortinetfortimail" device revision 131.
@@ -171,6 +175,8 @@ will be found under `rsa.raw`. The default is false.
 [float]
 ==== `fortimanager` fileset settings
 
+deprecated::[8.12.0,"This fileset is deprecated. Use the https://docs.elastic.co/integrations/fortinet_fortimanager[Fortinet FortiManager Logs] Elastic integration instead."]
+
 experimental[]
 
 NOTE: This was converted from RSA NetWitness log parser XML "fortinetmgr" device revision 134.
diff --git a/filebeat/docs/modules/imperva.asciidoc b/filebeat/docs/modules/imperva.asciidoc
index 085c44e126b..efe2a0bcdab 100644
--- a/filebeat/docs/modules/imperva.asciidoc
+++ b/filebeat/docs/modules/imperva.asciidoc
@@ -12,6 +12,8 @@ This file is generated! See scripts/docs_collector.py
 
 == Imperva module
 
+deprecated::[8.12.0,"This module is deprecated. See <<migrate-from-deprecated-module>> for migration options."]
+
 experimental[]
 
 include::{libbeat-dir}/shared/integration-link.asciidoc[]
diff --git a/filebeat/docs/modules/infoblox.asciidoc b/filebeat/docs/modules/infoblox.asciidoc
index 50539d2f9bd..2cc018bd20b 100644
--- a/filebeat/docs/modules/infoblox.asciidoc
+++ b/filebeat/docs/modules/infoblox.asciidoc
@@ -12,6 +12,8 @@ This file is generated! See scripts/docs_collector.py
 
 == Infoblox module
 
+deprecated::[8.12.0,"This module is deprecated. Use the https://docs.elastic.co/integrations/infoblox_nios[Infoblox NIOS] Elastic integration instead."]
+
 experimental[]
 
 include::{libbeat-dir}/shared/integration-link.asciidoc[]
diff --git a/filebeat/docs/modules/juniper.asciidoc b/filebeat/docs/modules/juniper.asciidoc
index 274c559fae2..dd445e809a7 100644
--- a/filebeat/docs/modules/juniper.asciidoc
+++ b/filebeat/docs/modules/juniper.asciidoc
@@ -142,6 +142,8 @@ This is a list of JunOS fields that are mapped to ECS.
 [float]
 ==== `junos` fileset settings
 
+deprecated::[8.12.0,"This fileset is deprecated. Use the https://docs.elastic.co/integrations/juniper_srx[Juniper SRX] Elastic integration instead."]
+
 experimental[]
 
 NOTE: This was converted from RSA NetWitness log parser XML "junosrouter" device revision 134.
@@ -187,6 +189,8 @@ will be found under `rsa.raw`. The default is false.
 [float]
 ==== `netscreen` fileset settings
 
+deprecated::[8.12.0,"This fileset is deprecated. See <<migrate-from-deprecated-module>> for migration options."]
+
 experimental[]
 
 NOTE: This was converted from RSA NetWitness log parser XML "netscreen" device revision 134.
diff --git a/filebeat/docs/modules/microsoft.asciidoc b/filebeat/docs/modules/microsoft.asciidoc
index 2772f12d3f1..4e5ff72b30b 100644
--- a/filebeat/docs/modules/microsoft.asciidoc
+++ b/filebeat/docs/modules/microsoft.asciidoc
@@ -224,6 +224,8 @@ And for all other Defender ATP event types, go to Host -> Events.
 [float]
 ==== `dhcp` fileset settings
 
+deprecated::[8.12.0,"This fileset is deprecated. Use the https://docs.elastic.co/integrations/microsoft_dhcp[Microsoft DHCP] Elastic integration instead."]
+
 experimental[]
 
 NOTE: This was converted from RSA NetWitness log parser XML "msdhcp" device revision 99.
diff --git a/filebeat/docs/modules/netscout.asciidoc b/filebeat/docs/modules/netscout.asciidoc
index 552153d1c67..2a9bfe34f67 100644
--- a/filebeat/docs/modules/netscout.asciidoc
+++ b/filebeat/docs/modules/netscout.asciidoc
@@ -12,6 +12,8 @@ This file is generated! See scripts/docs_collector.py
 
 == Netscout module
 
+deprecated::[8.12.0,"This module is deprecated. See <<migrate-from-deprecated-module>> for migration options."]
+
 experimental[]
 
 This is a module for receiving Arbor Peakflow SP logs over Syslog or a file.
diff --git a/filebeat/docs/modules/proofpoint.asciidoc b/filebeat/docs/modules/proofpoint.asciidoc
index 5f58e6764f3..cb420ae1e10 100644
--- a/filebeat/docs/modules/proofpoint.asciidoc
+++ b/filebeat/docs/modules/proofpoint.asciidoc
@@ -12,6 +12,8 @@ This file is generated! See scripts/docs_collector.py
 
 == Proofpoint module
 
+deprecated::[8.12.0,"This module is deprecated. Use the https://docs.elastic.co/integrations/proofpoint_tap[Proofpoint TAP] Elastic integration instead."]
+
 experimental[]
 
 include::{libbeat-dir}/shared/integration-link.asciidoc[]
diff --git a/filebeat/docs/modules/radware.asciidoc b/filebeat/docs/modules/radware.asciidoc
index 23ad0b7a179..1ebab4928e4 100644
--- a/filebeat/docs/modules/radware.asciidoc
+++ b/filebeat/docs/modules/radware.asciidoc
@@ -12,6 +12,8 @@ This file is generated! See scripts/docs_collector.py
 
 == Radware module
 
+deprecated::[8.12.0,"This module is deprecated. See <<migrate-from-deprecated-module>> for migration options."]
+
 experimental[]
 
 include::{libbeat-dir}/shared/integration-link.asciidoc[]
diff --git a/filebeat/docs/modules/snort.asciidoc b/filebeat/docs/modules/snort.asciidoc
index 8599c6d3e65..0a5c7c0b1c0 100644
--- a/filebeat/docs/modules/snort.asciidoc
+++ b/filebeat/docs/modules/snort.asciidoc
@@ -12,6 +12,8 @@ This file is generated! See scripts/docs_collector.py
 
 == Snort module
 
+deprecated::[8.12.0,"This module is deprecated. Use the https://docs.elastic.co/integrations/snort[Snort] Elastic integration instead."]
+
 experimental[]
 
 include::{libbeat-dir}/shared/integration-link.asciidoc[]
diff --git a/filebeat/docs/modules/sonicwall.asciidoc b/filebeat/docs/modules/sonicwall.asciidoc
index bd8803659fe..a760da67ba0 100644
--- a/filebeat/docs/modules/sonicwall.asciidoc
+++ b/filebeat/docs/modules/sonicwall.asciidoc
@@ -12,6 +12,8 @@ This file is generated! See scripts/docs_collector.py
 
 == Sonicwall module
 
+deprecated::[8.12.0,"This module is deprecated. Use the https://docs.elastic.co/integrations/sonicwall[SonicWall Firewall] Elastic integration instead."]
+
 experimental[]
 
 include::{libbeat-dir}/shared/integration-link.asciidoc[]
diff --git a/filebeat/docs/modules/sophos.asciidoc b/filebeat/docs/modules/sophos.asciidoc
index 1832e6603c3..a5d12dca366 100644
--- a/filebeat/docs/modules/sophos.asciidoc
+++ b/filebeat/docs/modules/sophos.asciidoc
@@ -152,6 +152,8 @@ This is a list of SophosXG fields that are mapped to ECS.
 [float]
 ==== `utm` fileset settings
 
+deprecated::[8.12.0,"This fileset is deprecated. Use the https://docs.elastic.co/integrations/sophos[Sophos] Elastic integration instead."]
+
 experimental[]
 
 NOTE: This was converted from RSA NetWitness log parser XML "astarosg" device revision 123.
diff --git a/filebeat/docs/modules/squid.asciidoc b/filebeat/docs/modules/squid.asciidoc
index 785fdac83cc..3f10e40ddd8 100644
--- a/filebeat/docs/modules/squid.asciidoc
+++ b/filebeat/docs/modules/squid.asciidoc
@@ -12,6 +12,8 @@ This file is generated! See scripts/docs_collector.py
 
 == Squid module
 
+deprecated::[8.12.0,"This module is deprecated. See <<migrate-from-deprecated-module>> for migration options."]
+
 experimental[]
 
 include::{libbeat-dir}/shared/integration-link.asciidoc[]
diff --git a/filebeat/docs/modules/tomcat.asciidoc b/filebeat/docs/modules/tomcat.asciidoc
index bf64a816b05..14aa52b2921 100644
--- a/filebeat/docs/modules/tomcat.asciidoc
+++ b/filebeat/docs/modules/tomcat.asciidoc
@@ -12,6 +12,8 @@ This file is generated! See scripts/docs_collector.py
 
 == Tomcat module
 
+deprecated::[8.12.0,"This module is deprecated. Use the https://docs.elastic.co/integrations/apache_tomcat[Apache Tomcat] Elastic integration instead."]
+
 experimental[]
 
 include::{libbeat-dir}/shared/integration-link.asciidoc[]
diff --git a/filebeat/docs/modules/zscaler.asciidoc b/filebeat/docs/modules/zscaler.asciidoc
index 25f914cb088..b6adfd84400 100644
--- a/filebeat/docs/modules/zscaler.asciidoc
+++ b/filebeat/docs/modules/zscaler.asciidoc
@@ -12,6 +12,8 @@ This file is generated! See scripts/docs_collector.py
 
 == Zscaler module
 
+deprecated::[8.12.0,"This module is deprecated. Use the https://docs.elastic.co/integrations/zscaler_zia[Zscaler Internet Access] Elastic integration instead."]
+
 experimental[]
 
 //temporarily override modulename to create working link
diff --git a/x-pack/filebeat/module/barracuda/_meta/docs.asciidoc b/x-pack/filebeat/module/barracuda/_meta/docs.asciidoc
index 79d27b36166..abca823d933 100644
--- a/x-pack/filebeat/module/barracuda/_meta/docs.asciidoc
+++ b/x-pack/filebeat/module/barracuda/_meta/docs.asciidoc
@@ -5,6 +5,8 @@
 
 == Barracuda module
 
+deprecated::[8.12.0,"This module is deprecated. Use the https://docs.elastic.co/integrations/barracuda[Barracuda Web Application Firewall] Elastic integration instead."]
+
 experimental[]
 
 include::{libbeat-dir}/shared/integration-link.asciidoc[]
diff --git a/x-pack/filebeat/module/bluecoat/_meta/docs.asciidoc b/x-pack/filebeat/module/bluecoat/_meta/docs.asciidoc
index 3497b6873ea..33fe07fd426 100644
--- a/x-pack/filebeat/module/bluecoat/_meta/docs.asciidoc
+++ b/x-pack/filebeat/module/bluecoat/_meta/docs.asciidoc
@@ -5,6 +5,8 @@
 
 == Bluecoat module
 
+deprecated::[8.12.0,"This module is deprecated. See <<migrate-from-deprecated-module>> for migration options."]
+
 experimental[]
 
 include::{libbeat-dir}/shared/integration-link.asciidoc[]
diff --git a/x-pack/filebeat/module/cisco/_meta/docs.asciidoc b/x-pack/filebeat/module/cisco/_meta/docs.asciidoc
index 6375c1999e8..eb4777ea0b4 100644
--- a/x-pack/filebeat/module/cisco/_meta/docs.asciidoc
+++ b/x-pack/filebeat/module/cisco/_meta/docs.asciidoc
@@ -274,6 +274,8 @@ include::../include/timezone-support.asciidoc[]
 [float]
 ==== `nexus` fileset settings
 
+deprecated::[8.12.0,"This fileset is deprecated. Use the https://docs.elastic.co/integrations/cisco_nexus[Cisco Nexus] Elastic integration instead."]
+
 experimental[]
 
 NOTE: This was converted from RSA NetWitness log parser XML "cisconxos" device revision 134.
@@ -319,6 +321,8 @@ will be found under `rsa.raw`. The default is false.
 [float]
 ==== `meraki` fileset settings
 
+deprecated::[8.12.0,"This fileset is deprecated. Use the https://docs.elastic.co/integrations/cisco_meraki[Cisco Meraki] Elastic integration instead."]
+
 experimental[]
 
 NOTE: This was converted from RSA NetWitness log parser XML "ciscomeraki" device revision 118.
diff --git a/x-pack/filebeat/module/cylance/_meta/docs.asciidoc b/x-pack/filebeat/module/cylance/_meta/docs.asciidoc
index 4cd22f8b797..f8cff0616f4 100644
--- a/x-pack/filebeat/module/cylance/_meta/docs.asciidoc
+++ b/x-pack/filebeat/module/cylance/_meta/docs.asciidoc
@@ -5,6 +5,8 @@
 
 == Cylance module
 
+deprecated::[8.12.0,"This module is deprecated. See <<migrate-from-deprecated-module>> for migration options."]
+
 experimental[]
 
 include::{libbeat-dir}/shared/integration-link.asciidoc[]
diff --git a/x-pack/filebeat/module/f5/_meta/docs.asciidoc b/x-pack/filebeat/module/f5/_meta/docs.asciidoc
index e83d14081ff..28d57c59be5 100644
--- a/x-pack/filebeat/module/f5/_meta/docs.asciidoc
+++ b/x-pack/filebeat/module/f5/_meta/docs.asciidoc
@@ -5,6 +5,8 @@
 
 == F5 module
 
+deprecated::[8.12.0,"This module is deprecated. Use the https://docs.elastic.co/integrations/f5_bigip[F5 BIG-IP] Elastic integration instead."]
+
 experimental[]
 
 include::{libbeat-dir}/shared/integration-link.asciidoc[]
diff --git a/x-pack/filebeat/module/fortinet/_meta/docs.asciidoc b/x-pack/filebeat/module/fortinet/_meta/docs.asciidoc
index 2cd30c1437a..4b224e49019 100644
--- a/x-pack/filebeat/module/fortinet/_meta/docs.asciidoc
+++ b/x-pack/filebeat/module/fortinet/_meta/docs.asciidoc
@@ -74,6 +74,8 @@ events. Defaults to `[fortinet-firewall, forwarded]`.
 [float]
 ==== `clientendpoint` fileset settings
 
+deprecated::[8.12.0,"This fileset is deprecated. Use the https://docs.elastic.co/integrations/fortinet_forticlient[Fortinet FortiClient Logs] Elastic integration instead."]
+
 experimental[]
 
 NOTE: This was converted from RSA NetWitness log parser XML "forticlientendpoint" device revision 0.
@@ -119,6 +121,8 @@ will be found under `rsa.raw`. The default is false.
 [float]
 ==== `fortimail` fileset settings
 
+deprecated::[8.12.0,"This fileset is deprecated. Use the https://docs.elastic.co/integrations/fortinet_fortimail[Fortinet FortiMail] Elastic integration instead."]
+
 experimental[]
 
 NOTE: This was converted from RSA NetWitness log parser XML "fortinetfortimail" device revision 131.
@@ -164,6 +168,8 @@ will be found under `rsa.raw`. The default is false.
 [float]
 ==== `fortimanager` fileset settings
 
+deprecated::[8.12.0,"This fileset is deprecated. Use the https://docs.elastic.co/integrations/fortinet_fortimanager[Fortinet FortiManager Logs] Elastic integration instead."]
+
 experimental[]
 
 NOTE: This was converted from RSA NetWitness log parser XML "fortinetmgr" device revision 134.
diff --git a/x-pack/filebeat/module/imperva/_meta/docs.asciidoc b/x-pack/filebeat/module/imperva/_meta/docs.asciidoc
index c5b1ab37691..6639cabb9b7 100644
--- a/x-pack/filebeat/module/imperva/_meta/docs.asciidoc
+++ b/x-pack/filebeat/module/imperva/_meta/docs.asciidoc
@@ -5,6 +5,8 @@
 
 == Imperva module
 
+deprecated::[8.12.0,"This module is deprecated. See <<migrate-from-deprecated-module>> for migration options."]
+
 experimental[]
 
 include::{libbeat-dir}/shared/integration-link.asciidoc[]
diff --git a/x-pack/filebeat/module/infoblox/_meta/docs.asciidoc b/x-pack/filebeat/module/infoblox/_meta/docs.asciidoc
index 1be04b5b739..dc894b8f3c3 100644
--- a/x-pack/filebeat/module/infoblox/_meta/docs.asciidoc
+++ b/x-pack/filebeat/module/infoblox/_meta/docs.asciidoc
@@ -5,6 +5,8 @@
 
 == Infoblox module
 
+deprecated::[8.12.0,"This module is deprecated. Use the https://docs.elastic.co/integrations/infoblox_nios[Infoblox NIOS] Elastic integration instead."]
+
 experimental[]
 
 include::{libbeat-dir}/shared/integration-link.asciidoc[]
diff --git a/x-pack/filebeat/module/juniper/_meta/docs.asciidoc b/x-pack/filebeat/module/juniper/_meta/docs.asciidoc
index 7de15937c4e..a33b9c03a83 100644
--- a/x-pack/filebeat/module/juniper/_meta/docs.asciidoc
+++ b/x-pack/filebeat/module/juniper/_meta/docs.asciidoc
@@ -135,6 +135,8 @@ This is a list of JunOS fields that are mapped to ECS.
 [float]
 ==== `junos` fileset settings
 
+deprecated::[8.12.0,"This fileset is deprecated. Use the https://docs.elastic.co/integrations/juniper_srx[Juniper SRX] Elastic integration instead."]
+
 experimental[]
 
 NOTE: This was converted from RSA NetWitness log parser XML "junosrouter" device revision 134.
@@ -180,6 +182,8 @@ will be found under `rsa.raw`. The default is false.
 [float]
 ==== `netscreen` fileset settings
 
+deprecated::[8.12.0,"This fileset is deprecated. See <<migrate-from-deprecated-module>> for migration options."]
+
 experimental[]
 
 NOTE: This was converted from RSA NetWitness log parser XML "netscreen" device revision 134.
diff --git a/x-pack/filebeat/module/microsoft/_meta/docs.asciidoc b/x-pack/filebeat/module/microsoft/_meta/docs.asciidoc
index b075caa035b..048354d95a8 100644
--- a/x-pack/filebeat/module/microsoft/_meta/docs.asciidoc
+++ b/x-pack/filebeat/module/microsoft/_meta/docs.asciidoc
@@ -217,6 +217,8 @@ And for all other Defender ATP event types, go to Host -> Events.
 [float]
 ==== `dhcp` fileset settings
 
+deprecated::[8.12.0,"This fileset is deprecated. Use the https://docs.elastic.co/integrations/microsoft_dhcp[Microsoft DHCP] Elastic integration instead."]
+
 experimental[]
 
 NOTE: This was converted from RSA NetWitness log parser XML "msdhcp" device revision 99.
diff --git a/x-pack/filebeat/module/netscout/_meta/docs.asciidoc b/x-pack/filebeat/module/netscout/_meta/docs.asciidoc
index 463c93b5c0f..6ae6035957e 100644
--- a/x-pack/filebeat/module/netscout/_meta/docs.asciidoc
+++ b/x-pack/filebeat/module/netscout/_meta/docs.asciidoc
@@ -5,6 +5,8 @@
 
 == Netscout module
 
+deprecated::[8.12.0,"This module is deprecated. See <<migrate-from-deprecated-module>> for migration options."]
+
 experimental[]
 
 This is a module for receiving Arbor Peakflow SP logs over Syslog or a file.
diff --git a/x-pack/filebeat/module/proofpoint/_meta/docs.asciidoc b/x-pack/filebeat/module/proofpoint/_meta/docs.asciidoc
index 21a768ab432..0e678fa7896 100644
--- a/x-pack/filebeat/module/proofpoint/_meta/docs.asciidoc
+++ b/x-pack/filebeat/module/proofpoint/_meta/docs.asciidoc
@@ -5,6 +5,8 @@
 
 == Proofpoint module
 
+deprecated::[8.12.0,"This module is deprecated. Use the https://docs.elastic.co/integrations/proofpoint_tap[Proofpoint TAP] Elastic integration instead."]
+
 experimental[]
 
 include::{libbeat-dir}/shared/integration-link.asciidoc[]
diff --git a/x-pack/filebeat/module/radware/_meta/docs.asciidoc b/x-pack/filebeat/module/radware/_meta/docs.asciidoc
index ba9bc87444c..834586f8535 100644
--- a/x-pack/filebeat/module/radware/_meta/docs.asciidoc
+++ b/x-pack/filebeat/module/radware/_meta/docs.asciidoc
@@ -5,6 +5,8 @@
 
 == Radware module
 
+deprecated::[8.12.0,"This module is deprecated. See <<migrate-from-deprecated-module>> for migration options."]
+
 experimental[]
 
 include::{libbeat-dir}/shared/integration-link.asciidoc[]
diff --git a/x-pack/filebeat/module/snort/_meta/docs.asciidoc b/x-pack/filebeat/module/snort/_meta/docs.asciidoc
index 3170a20db9d..025afa52f35 100644
--- a/x-pack/filebeat/module/snort/_meta/docs.asciidoc
+++ b/x-pack/filebeat/module/snort/_meta/docs.asciidoc
@@ -5,6 +5,8 @@
 
 == Snort module
 
+deprecated::[8.12.0,"This module is deprecated. Use the https://docs.elastic.co/integrations/snort[Snort] Elastic integration instead."]
+
 experimental[]
 
 include::{libbeat-dir}/shared/integration-link.asciidoc[]
diff --git a/x-pack/filebeat/module/sonicwall/_meta/docs.asciidoc b/x-pack/filebeat/module/sonicwall/_meta/docs.asciidoc
index d1f82f17dd2..adccfd17799 100644
--- a/x-pack/filebeat/module/sonicwall/_meta/docs.asciidoc
+++ b/x-pack/filebeat/module/sonicwall/_meta/docs.asciidoc
@@ -5,6 +5,8 @@
 
 == Sonicwall module
 
+deprecated::[8.12.0,"This module is deprecated. Use the https://docs.elastic.co/integrations/sonicwall[SonicWall Firewall] Elastic integration instead."]
+
 experimental[]
 
 include::{libbeat-dir}/shared/integration-link.asciidoc[]
diff --git a/x-pack/filebeat/module/sophos/_meta/docs.asciidoc b/x-pack/filebeat/module/sophos/_meta/docs.asciidoc
index 6d6147984a1..f998d7ce62c 100644
--- a/x-pack/filebeat/module/sophos/_meta/docs.asciidoc
+++ b/x-pack/filebeat/module/sophos/_meta/docs.asciidoc
@@ -145,6 +145,8 @@ This is a list of SophosXG fields that are mapped to ECS.
 [float]
 ==== `utm` fileset settings
 
+deprecated::[8.12.0,"This fileset is deprecated. Use the https://docs.elastic.co/integrations/sophos[Sophos] Elastic integration instead."]
+
 experimental[]
 
 NOTE: This was converted from RSA NetWitness log parser XML "astarosg" device revision 123.
diff --git a/x-pack/filebeat/module/squid/_meta/docs.asciidoc b/x-pack/filebeat/module/squid/_meta/docs.asciidoc
index 10411c4f73d..25a8e1edc1e 100644
--- a/x-pack/filebeat/module/squid/_meta/docs.asciidoc
+++ b/x-pack/filebeat/module/squid/_meta/docs.asciidoc
@@ -5,6 +5,8 @@
 
 == Squid module
 
+deprecated::[8.12.0,"This module is deprecated. See <<migrate-from-deprecated-module>> for migration options."]
+
 experimental[]
 
 include::{libbeat-dir}/shared/integration-link.asciidoc[]
diff --git a/x-pack/filebeat/module/tomcat/_meta/docs.asciidoc b/x-pack/filebeat/module/tomcat/_meta/docs.asciidoc
index d56df0ba01b..cb7339f3388 100644
--- a/x-pack/filebeat/module/tomcat/_meta/docs.asciidoc
+++ b/x-pack/filebeat/module/tomcat/_meta/docs.asciidoc
@@ -5,6 +5,8 @@
 
 == Tomcat module
 
+deprecated::[8.12.0,"This module is deprecated. Use the https://docs.elastic.co/integrations/apache_tomcat[Apache Tomcat] Elastic integration instead."]
+
 experimental[]
 
 include::{libbeat-dir}/shared/integration-link.asciidoc[]
diff --git a/x-pack/filebeat/module/zscaler/_meta/docs.asciidoc b/x-pack/filebeat/module/zscaler/_meta/docs.asciidoc
index 1c62e822558..8a1b07a1372 100644
--- a/x-pack/filebeat/module/zscaler/_meta/docs.asciidoc
+++ b/x-pack/filebeat/module/zscaler/_meta/docs.asciidoc
@@ -5,6 +5,8 @@
 
 == Zscaler module
 
+deprecated::[8.12.0,"This module is deprecated. Use the https://docs.elastic.co/integrations/zscaler_zia[Zscaler Internet Access] Elastic integration instead."]
+
 experimental[]
 
 //temporarily override modulename to create working link