mimecast: fix rendering of CEL programs in config files (elastic#12542)

We see situations where the CEL program is rendered in double quoted strings in the pre-config.yml in diagnostic bundles, making it difficult to read. The cause of this has now been identified as the presence of trailing whitespace on lines[1]. So remove those. [1]go-yaml/yaml#1041 (comment)
kush-elastic · Jan 30, 2025 · b5f010f · b5f010f
1 parent 274e632
commit b5f010f
Show file tree

Hide file tree

Showing 7 changed files with 16 additions and 11 deletions.
diff --git a/packages/mimecast/changelog.yml b/packages/mimecast/changelog.yml
@@ -1,4 +1,9 @@
 # newer versions go on top
+- version: "2.4.3"
+  changes:
+    - description: Fix rendering of CEL programs in configuration.
+      type: bugfix
+      link: https://github.com/elastic/integrations/pull/12542
 - version: "2.4.2"
   changes:
     - description: Fix cursor time formatting and selection.

diff --git a/packages/mimecast/data_stream/audit_events/agent/stream/cel.yml.hbs b/packages/mimecast/data_stream/audit_events/agent/stream/cel.yml.hbs
@@ -65,7 +65,7 @@ program: |
           state.end_field: now.format(time_layout.RFC3339),
         }]),
       }.as(req,
-        post_request(state.url.trim_right("/") + state.path, "application/json", 
+        post_request(state.url.trim_right("/") + state.path, "application/json",
           {
             "meta": {
               "pagination": {
@@ -77,7 +77,7 @@ program: |
           }.encode_json()
         ).with({
           "Header": {
-            "Authorization": ["Bearer " + token.access_token], 
+            "Authorization": ["Bearer " + token.access_token],
             "Accept": ["application/json"],
             "Content-Type": ["application/json"],
           }

diff --git a/packages/mimecast/data_stream/cloud_integrated_logs/agent/stream/cel.yml.hbs b/packages/mimecast/data_stream/cloud_integrated_logs/agent/stream/cel.yml.hbs
@@ -83,7 +83,7 @@ program: |
           }.format_query()
         ).with({
           "Header": {
-            "Authorization": ["Bearer " + token.access_token], 
+            "Authorization": ["Bearer " + token.access_token],
             "Accept": ["application/json"],
             "Content-Type": ["application/json"],
           }
@@ -128,7 +128,7 @@ program: |
             }.as(to_publish, to_publish.with({
               "want_more": to_publish.want_more || size(to_publish.cursor.work_list) != 0,
             }))
-          ).as(state, 
+          ).as(state,
             // Check whether we still need to get more, but have
             // no event for this type. If we do, populate events
             // with a place-holder to be discarded by the ingest

diff --git a/packages/mimecast/data_stream/siem_logs/agent/stream/cel.yml.hbs b/packages/mimecast/data_stream/siem_logs/agent/stream/cel.yml.hbs
@@ -83,7 +83,7 @@ program: |
           }.format_query()
         ).with({
           "Header": {
-            "Authorization": ["Bearer " + token.access_token], 
+            "Authorization": ["Bearer " + token.access_token],
             "Accept": ["application/json"],
             "Content-Type": ["application/json"],
           }
@@ -128,7 +128,7 @@ program: |
             }.as(to_publish, to_publish.with({
               "want_more": to_publish.want_more || size(to_publish.cursor.work_list) != 0,
             }))
-          ).as(state, 
+          ).as(state,
             // Check whether we still need to get more, but have
             // no event for this type. If we do, populate events
             // with a place-holder to be discarded by the ingest

diff --git a/packages/mimecast/data_stream/threat_intel_malware_customer/agent/stream/cel.yml.hbs b/packages/mimecast/data_stream/threat_intel_malware_customer/agent/stream/cel.yml.hbs
@@ -73,11 +73,11 @@ program: |
           "fileType": "stix",
         }]),
       }.as(req,
-        post_request(state.url.trim_right("/") + state.path, "application/json", 
+        post_request(state.url.trim_right("/") + state.path, "application/json",
           req.encode_json()
         ).with({
           "Header": {
-            "Authorization": ["Bearer " + token.access_token], 
+            "Authorization": ["Bearer " + token.access_token],
             "Accept": ["application/json"],
             "Content-Type": ["application/json"],
           }

diff --git a/packages/mimecast/data_stream/threat_intel_malware_grid/agent/stream/cel.yml.hbs b/packages/mimecast/data_stream/threat_intel_malware_grid/agent/stream/cel.yml.hbs
@@ -73,11 +73,11 @@ program: |
           "fileType": "stix",
         }]),
       }.as(req,
-        post_request(state.url.trim_right("/") + state.path, "application/json", 
+        post_request(state.url.trim_right("/") + state.path, "application/json",
           req.encode_json()
         ).with({
           "Header": {
-            "Authorization": ["Bearer " + token.access_token], 
+            "Authorization": ["Bearer " + token.access_token],
             "Accept": ["application/json"],
             "Content-Type": ["application/json"],
           }

diff --git a/packages/mimecast/manifest.yml b/packages/mimecast/manifest.yml
@@ -1,7 +1,7 @@
 format_version: "3.0.2"
 name: mimecast
 title: "Mimecast"
-version: "2.4.2"
+version: "2.4.3"
 description: Collect logs from Mimecast with Elastic Agent.
 type: integration
 categories: ["security", "email_security"]