fix integrations with failing parsing hbs templates

[teresaromero]

Proposed commit message

netskope and auditd_manager fixed on hbs syntax

Checklist

• I have reviewed tips for building integrations and this pull request is aligned with them.
• I have verified that all data streams collect metrics or logs.
• I have added an entry to my package's changelog.yml file.
• I have verified that Kibana version constraints are current according to guidelines.
• I have verified that any added dashboard complies with Kibana's Dashboard good practices

Author's Checklist

• [ ]

How to test this PR locally

This PR fixes errors on the integrations that do not have valid handlebars format. This is a new validation rule that would be available at package-spec. Integrations affected are:

netskope error when using gcs

• install netskope
• choose Collect logs from Netskope using Log Streaming via GCS so the data stream with the fault is used

With this change this error does not appear.

auditd_manager default audit rules format

The use of multiline string inside the helper is not compliant with handlebars. The file has been changed so the default values are a single line. The helper still formats the variable input from the user.

Related issues

Related elastic/package-spec#1030

[elastic-vault-github-plugin-prod]

🚀 Benchmarks report

To see the full report comment with /test benchmark fullreport

[mrodm]

Should this closing "if" be moved between line 41 and 42 (after setting all tags)?

--- packages/netskope/data_stream/alerts_events_v2/agent/stream/gcs.yml.hbs
+++ packages/netskope/data_stream/alerts_events_v2/agent/stream/gcs.yml.hbs
@@ -39,6 +39,7 @@ tags:
 {{#each tags as |tag|}}
   - {{tag}}
 {{/each}}
+{{/if}}
 {{#contains "forwarded" tags}}
 publisher_pipeline.disable_host: true
 {{/contains}}
@@ -46,4 +47,3 @@ publisher_pipeline.disable_host: true
 processors:
 {{processors}}
 {{/if}}
-{{/if}}

[mrodm]

Or should it be after checking the forwarded tag ?

--- packages/netskope/data_stream/alerts_events_v2/agent/stream/gcs.yml.hbs
+++ packages/netskope/data_stream/alerts_events_v2/agent/stream/gcs.yml.hbs
@@ -42,8 +42,8 @@ tags:
 {{#contains "forwarded" tags}}
 publisher_pipeline.disable_host: true
 {{/contains}}
+{{/if}}
 {{#if processors}}
 processors:
 {{processors}}
 {{/if}}
-{{/if}}

[teresaromero]

yes, you are right, i've changed into before forwarded, as this condition is based on tags but does not modify the tag list, it adds a bool variable to the policy.
I've checked this changed adding two policy test to the package 🧪

[elasticmachine]

Pinging @elastic/sec-linux-platform (Team:Security-Linux Platform)

[elasticmachine]

Pinging @elastic/security-service-integrations (Team:Security-Service Integrations)

[kcreddy]

netskope changes LGTM ✅

[elasticmachine]

💛 Build succeeded, but was flaky

• Buildkite Build
• Commit: 802e947

Failed CI Steps

• Check integrations netskope

History

• 💚 Build #35494 succeeded 0d0dd2a
• 💚 Build #35398 succeeded b17d38d
• 💚 Build #35397 succeeded 6764b12
• 💚 Build #35395 succeeded a92b6a5

[teresaromero]

@elastic/sec-linux-platform hi! could you take a look to this change? thanks!