Incorrect logic for checking if tags contains 'forwarded'

[andrewkroh]

Packages use a Handlebar template function to check if tags contains forwarded as a value. But they put the arguments to the function in the wrong order. The function is defined at https://github.com/elastic/kibana/blob/fd0c1fa490c2e4eab5a3cbc96c8f3703cc4962f6/x-pack/plugins/fleet/server/services/epm/agent/agent.ts#L114.

The impact is that when tags contains more than just [forwarded] then host.name of the Agent is included rather than allowing the forwarded host.name value to pass through.

CORRECT Usage:

{{#contains "forwarded" tags}}

WRONG:

{{#contains tags "forwarded"}}

Affected Integrations

• apache
• auditd
• aws
• azure
• barracuda
• bluecoat
• carbonblack_edr
• checkpoint
• cisco
• cisco_asa
• cisco_ftd
• cisco_ios
• cisco_meraki
• cisco_nexus
• cisco_umbrella
• cloudflare
• crowdstrike
• cyberark
• cyberarkpas
• cylance
• f5
• fortinet
• gcp
• google_workspace
• haproxy
• hashicorp_vault
• iis
• imperva
• infoblox
• iptables
• juniper
• kafka
• microsoft
• modsecurity
• mongodb
• nats
• netflow
• netscout
• nginx
• nginx_ingress_controller
• o365
• okta
• osquery
• panw
• panw_cortex_xdr
• pfsense
• postgresql
• proofpoint
• rabbitmq
• radware
• redis
• santa
• sonicwall
• sophos
• squid
• stan
• suricata
• system
• tomcat
• traefik
• vsphere
• windows
• winlog
• zeek
• zerofox
• zoom
• zscaler

[andrewkroh]

This was fixed by a series of PRs. https://github.com/elastic/integrations/search?q=Fix+contains+check+for+forwarded+tag&type=issues