Skip to content

[Filebeat] Do not run o365audit input and o365 module in FIPS builds #44909

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
ycombinator merged 10 commits into from
Jun 25, 2025
Merged

[Filebeat] Do not run o365audit input and o365 module in FIPS builds #44909

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
10 commits
Select commit Hold shift + click to select a range
4018c0e
Return error in FIPS mode if input wants to opt-out of FIPS distribut…
ycombinator Jun 25, 2025
cbd1305
Add ability for Filebeat plugins (inputs) to specify that they should…
ycombinator Jun 23, 2025
96c04aa
Remove ExcludeForFIPS implementation
ycombinator Jun 24, 2025
8dfbcba
Make o365 input use FIPSAwareInput interface
ycombinator Jun 24, 2025
78dfd98
Remove debugging statement
ycombinator Jun 24, 2025
d2580c7
Adding godoc comments for implementations of the IsFIPSCapable() method
ycombinator Jun 24, 2025
cd0de75
Add doc about module availability
ycombinator Jun 18, 2025
daaddd6
Reimplementation
ycombinator Jun 25, 2025
c2aa36b
Remove duplicate imports
ycombinator Jun 25, 2025
c27d7eb
Fix redundant language
ycombinator Jun 25, 2025
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
7 changes: 7 additions & 0 deletions x-pack/filebeat/input/o365audit/input.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -65,6 +65,13 @@
Type: pluginName,
Configure: configure,
},

// ExcludeFromFIPS = true to prevent this input from being used in FIPS-capable
// Filebeat distributions. This input indirectly uses algorithms that are not
// FIPS-compliant. Specifically, the input depends on the
// github.com/Azure/azure-sdk-for-go/sdk/azidentity package which, in turn,
// depends on the golang.org/x/crypto/pkcs12 package, which is not FIPS-compliant.
ExcludeFromFIPS: true,
}
}

Expand Down Expand Up @@ -94,7 +101,7 @@
func (inp *o365input) Name() string { return pluginName }

func (inp *o365input) Test(src cursor.Source, ctx v2.TestContext) error {
tenantID := src.(*stream).tenantID

Check failure on line 104 in x-pack/filebeat/input/o365audit/input.go

View workflow job for this annotation

GitHub Actions / lint (ubuntu-latest) 

Error return value is not checked (errcheck)
auth, err := inp.config.NewTokenProvider(tenantID)
if err != nil {
return err
Expand Down
2 changes: 2 additions & 0 deletions x-pack/filebeat/module/o365/_meta/docs.asciidoc
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -5,6 +5,8 @@

== Office 365 module

WARNING: This module is not available in FIPS-capable Filebeat.

beta[]

include::{libbeat-dir}/shared/integration-link.asciidoc[]
Expand Down
Loading