Copy packages from snapshot to production (#5711)

packages/cloud_security_posture/0.0.32/LICENSE.txt

@@ -0,0 +1,93 @@
+Elastic License 2.0
+
+URL: https://www.elastic.co/licensing/elastic-license
+
+## Acceptance
+
+By using the software, you agree to all of the terms and conditions below.
+
+## Copyright License
+
+The licensor grants you a non-exclusive, royalty-free, worldwide,
+non-sublicensable, non-transferable license to use, copy, distribute, make
+available, and prepare derivative works of the software, in each case subject to
+the limitations and conditions below.
+
+## Limitations
+
+You may not provide the software to third parties as a hosted or managed
+service, where the service provides users with access to any substantial set of
+the features or functionality of the software.
+
+You may not move, change, disable, or circumvent the license key functionality
+in the software, and you may not remove or obscure any functionality in the
+software that is protected by the license key.
+
+You may not alter, remove, or obscure any licensing, copyright, or other notices
+of the licensor in the software. Any use of the licensor’s trademarks is subject
+to applicable law.
+
+## Patents
+
+The licensor grants you a license, under any patent claims the licensor can
+license, or becomes able to license, to make, have made, use, sell, offer for
+sale, import and have imported the software, in each case subject to the
+limitations and conditions in this license. This license does not cover any
+patent claims that you cause to be infringed by modifications or additions to
+the software. If you or your company make any written claim that the software
+infringes or contributes to infringement of any patent, your patent license for
+the software granted under these terms ends immediately. If your company makes
+such a claim, your patent license ends immediately for work on behalf of your
+company.
+
+## Notices
+
+You must ensure that anyone who gets a copy of any part of the software from you
+also gets a copy of these terms.
+
+If you modify the software, you must include in any modified copies of the
+software prominent notices stating that you have modified the software.
+
+## No Other Rights
+
+These terms do not imply any licenses other than those expressly granted in
+these terms.
+
+## Termination
+
+If you use the software in violation of these terms, such use is not licensed,
+and your licenses will automatically terminate. If the licensor provides you
+with a notice of your violation, and you cease all violation of this license no
+later than 30 days after you receive that notice, your licenses will be
+reinstated retroactively. However, if you violate these terms after such
+reinstatement, any additional violation of these terms will cause your licenses
+to terminate automatically and permanently.
+
+## No Liability
+
+*As far as the law allows, the software comes as is, without any warranty or
+condition, and the licensor will not be liable to you for any damages arising
+out of these terms or the use or nature of the software, under any kind of
+legal claim.*
+
+## Definitions
+
+The **licensor** is the entity offering these terms, and the **software** is the
+software the licensor makes available under these terms, including any portion
+of it.
+
+**you** refers to the individual or entity agreeing to these terms.
+
+**your company** is any legal entity, sole proprietorship, or other kind of
+organization that you work for, plus all organizations that have control over,
+are under the control of, or are under common control with that
+organization. **control** means ownership of substantially all the assets of an
+entity, or the power to direct its management and policies by vote, contract, or
+otherwise. Control can be direct or indirect.
+
+**your licenses** are all the licenses granted to you for the software under
+these terms.
+
+**use** means anything you do with the software requiring one of your licenses.
+
+**trademark** means trademarks, service marks, and similar rights.

packages/cloud_security_posture/0.0.32/changelog.yml

@@ -0,0 +1,178 @@
+# newer versions go on top
+- version: "0.0.32"
+  changes:
+    - description: |
+        Add event property to finding, this event match the event spec of the ECS .
+        cycle_id mapping is removed as it is no longer reported by the Cloudbeat.
+      type: enhancement
+      link: https://github.com/elastic/integrations/pull/4016
+- version: "0.0.31"
+  changes:
+    - description: Store beat configuration file to be propagated to cloudbeat
+      type: enhancement
+      link: https://github.com/elastic/integrations/pull/4145
+- version: "0.0.30"
+  changes:
+    - description: Add AWS additional auth to KSPM integration
+      type: enhancement
+      link: https://github.com/elastic/integrations/pull/4168
+- version: "0.0.29"
+  changes:
+    - description: Update min age for delete to 180 days
+      type: enhancement
+      link: https://github.com/elastic/integrations/pull/4146
+- version: "0.0.28"
+  changes:
+    - description: Add ILM policy for the findings data stream
+      type: enhancement
+      link: https://github.com/elastic/integrations/pull/4039
+- version: "0.0.27"
+  changes:
+    - description: Update input types and var name to support runtime config
+      type: enhancement
+      link: https://github.com/elastic/integrations/pull/3968
+- version: "0.0.26"
+  changes:
+    - description: Version bump
+      type: enhancement
+      link: https://github.com/elastic/integrations/pull/3997
+    - description: Updates to KSPM Integration README
+      type: enhancement
+      link: https://github.com/elastic/integrations/pull/3964
+- version: "0.0.25"
+  changes:
+    - description: Remove unimplemented EKS rules from template
+      type: bugfix
+      link: https://github.com/elastic/integrations/pull/3973
+- version: "0.0.24"
+  changes:
+    - description: Updated release tag to beta
+      type: enhancement
+      link: https://github.com/elastic/integrations/pull/3966
+- version: "0.0.23"
+  changes:
+    - description: Fix rule id typo
+      type: bugfix
+      link: https://github.com/elastic/integrations/pull/3912
+- version: "0.0.22"
+  changes:
+    - description: Adjust findings data-stream mappings to fit ECS conventions
+      type: enhancement
+      link: https://github.com/elastic/integrations/pull/3775
+    - description: Turned off dynamic mappings of findings data-stream
+      type: enhancement
+      link: https://github.com/elastic/integrations/pull/3775
+    - description: Added default pipeline to findings data-stream
+      type: enhancement
+      link: https://github.com/elastic/integrations/pull/3775
+- version: "0.0.21"
+  changes:
+    - description: Update package display name
+      type: enhancement
+      link: https://github.com/elastic/integrations/pull/3817
+- version: "0.0.20"
+  changes:
+    - description: Remove Kibana configuration section from README
+      type: enhancement
+      link: https://github.com/elastic/integrations/pull/3726
+- version: "0.0.19"
+  changes:
+    - description: Adding EKS rule templates
+      type: enhancement
+      link: https://github.com/elastic/integrations/pull/3701
+    - description: Added date time field to index patterns
+      type: enhancement
+      link: https://github.com/elastic/integrations/pull/3709
+    - description: Update rule benchmark field to include an id
+      type: enhancement
+      link: https://github.com/elastic/integrations/pull/3654
+- version: "0.0.18"
+  changes:
+    - description: enhance integration to support eks
+      type: enhancement
+      link: https://github.com/elastic/integrations/pull/3619
+- version: "0.0.17"
+  changes:
+    - description: Refactored csp-rule-template `metadata` field to fit 8.4.0 schema
+      type: enhancement
+      link: https://github.com/elastic/integrations/pull/3561
+- version: "0.0.16"
+  changes:
+    - description: update resource id keyword mapping
+      type: enhancement
+      link: https://github.com/elastic/integrations/pull/3543
+- version: "0.0.15"
+  changes:
+    - description: update resource id mapping
+      type: enhancement
+      link: https://github.com/elastic/integrations/pull/3541
+- version: "0.0.14"
+  changes:
+    - description: Add mapping for rule id and resource id and revert Kibana version constrain
+      type: enhancement
+      link: https://github.com/elastic/integrations/pull/3503
+- version: "0.0.13"
+  changes:
+    - description: Update Kibana version constrain
+      type: enhancement
+      link: https://github.com/elastic/integrations/pull/3505
+- version: "0.0.12"
+  changes:
+    - description: Add new rule templates
+      type: enhancement
+      link: https://github.com/elastic/integrations/pull/3486
+- version: "0.0.11"
+  changes:
+    - description: Update elastic-agent deployment instructions
+      type: enhancement
+      link: https://github.com/elastic/integrations/pull/3382
+- version: "0.0.10"
+  changes:
+    - description: Update CSP rules configuration template
+      type: enhancement
+      link: https://github.com/elastic/integrations/pull/3346
+- version: "0.0.9"
+  changes:
+    - description: Update csp rule template
+      type: enhancement
+      link: https://github.com/elastic/integrations/pull/3273
+- version: "0.0.8"
+  changes:
+    - description: Send dataYaml (Rules Activation YAML) to cloudbeat
+      type: enhancement
+      link: https://github.com/elastic/integrations/pull/3241
+- version: "0.0.7"
+  changes:
+    - description: Add rule template assets
+      type: enhancement
+      link: https://github.com/elastic/integrations/pull/3257
+- version: "0.0.6"
+  changes:
+    - description: Update findings template asset
+      type: enhancement
+      link: https://github.com/elastic/integrations/pull/3248
+- version: "0.0.5"
+  changes:
+    - description: Add CSP rule template asset
+      type: enhancement
+      link: https://github.com/elastic/integrations/pull/3242
+- version: "0.0.4"
+  changes:
+    - description: Add latest findings data view
+      type: enhancement
+      link: https://github.com/elastic/integrations/pull/3183
+- version: "0.0.3"
+  changes:
+    - description: Change README
+      type: enhancement
+      link: https://github.com/elastic/integrations/pull/3207
+- version: "0.0.2"
+  changes:
+    - description: Change README
+      type: enhancement
+      link: https://github.com/elastic/integrations/pull/3190
+- version: "0.0.1"
+  changes:
+    - description: Initial draft of the package
+      type: enhancement
+      link: https://github.com/elastic/integrations/pull/3113

packages/cloud_security_posture/0.0.32/data_stream/findings/agent/stream/eks.yml.hbs

@@ -0,0 +1,45 @@
+name: Findings
+# Defines how often an event is sent to the output
+period: 4h
+fetchers:
+  - name: kube-api
+  - name: process
+    directory: "/hostfs"
+    processes:
+      kubelet:
+        config-file-arguments:
+        - config
+  - name: aws-ecr
+  - name: aws-elb
+  - name: file-system
+    patterns: [
+    "/hostfs/etc/kubernetes/kubelet/kubelet-config.json",
+    "/hostfs/var/lib/kubelet/kubeconfig",
+    ]
+processors:
+  - add_cluster_id: ~
+
+evaluator:
+  decision_logs: false
+
+{{#if runtimeCfg}}
+{{runtimeCfg}}
+{{/if}}
+{{#if access_key_id}}
+access_key_id: {{access_key_id}}
+{{/if}}
+{{#if secret_access_key}}
+secret_access_key: {{secret_access_key}}
+{{/if}}
+{{#if session_token}}
+session_token: {{session_token}}
+{{/if}}
+{{#if shared_credential_file}}
+shared_credential_file: {{shared_credential_file}}
+{{/if}}
+{{#if credential_profile_name}}
+credential_profile_name: {{credential_profile_name}}
+{{/if}}
+{{#if role_arn}}
+role_arn: {{role_arn}}
+{{/if}}

packages/cloud_security_posture/0.0.32/data_stream/findings/agent/stream/vanilla.yml.hbs

@@ -0,0 +1,40 @@
+name: Findings
+# Defines how often an event is sent to the output
+period: 4h
+fetchers:
+  - name: kube-api
+  - name: process
+    directory: "/hostfs"
+    processes:
+      etcd:
+      kube-apiserver:
+      kube-controller:
+      kube-scheduler:
+      kubelet:
+        config-file-arguments:
+        - config
+  - name: file-system
+    patterns: [
+      "/hostfs/etc/kubernetes/scheduler.conf",
+      "/hostfs/etc/kubernetes/controller-manager.conf",
+      "/hostfs/etc/kubernetes/admin.conf",
+      "/hostfs/etc/kubernetes/kubelet.conf",
+      "/hostfs/etc/kubernetes/manifests/etcd.yaml",
+      "/hostfs/etc/kubernetes/manifests/kube-apiserver.yaml",
+      "/hostfs/etc/kubernetes/manifests/kube-controller-manager.yaml",
+      "/hostfs/etc/kubernetes/manifests/kube-scheduler.yaml",
+      "/hostfs/etc/systemd/system/kubelet.service.d/10-kubeadm.conf",
+      "/hostfs/etc/kubernetes/pki/*",
+      "/hostfs/var/lib/kubelet/config.yaml",
+      "/hostfs/var/lib/etcd",
+      "/hostfs/etc/kubernetes/pki",
+    ]
+processors:
+  - add_cluster_id: ~
+
+evaluator:
+  decision_logs: false
+
+{{#if runtimeCfg}}
+{{runtimeCfg}}
+{{/if}}

packages/cloud_security_posture/0.0.32/data_stream/findings/elasticsearch/ilm/default_policy.json

@@ -0,0 +1,24 @@
+{
+    "policy": {
+        "phases": {
+            "hot": {
+                "min_age": "0ms",
+                "actions": {
+                    "rollover": {
+                        "max_age": "30d",
+                        "max_size": "50gb"
+                    },
+                    "set_priority": {
+                        "priority": 100
+                    }
+                }
+            },
+            "delete": {
+                "min_age": "180d",
+                "actions": {
+                    "delete": {}
+                }
+            }
+        }
+    }
+}

packages/cloud_security_posture/0.0.32/data_stream/findings/elasticsearch/ingest_pipeline/default.yml

@@ -0,0 +1,10 @@
+---
+description: Pipeline for cloudbeat findings
+processors:
+- set:
+    field: event.ingested
+    value: '{{_ingest.timestamp}}'
+on_failure:
+- set:
+    field: error.message
+    value: '{{ _ingest.on_failure_message }}'