search

elastic / integrations

Elastic Integrations
https://www.elastic.co/integrations
Other
23 stars 435 forks source link

Sophos Integration v2.11.0 Can't Create Policy due to Error: Bad Indentation of a Mapping Entry #6690

Closed ChestoOfGlen closed 1 year ago

ChestoOfGlen commented 1 year ago

We have an Elastic instance where we are using the Sophos integration for the Elastic agent to ingest logs from a logfile. We recently updated to the latest version of the integration, v2.11.0, along with updating to Elastic v8.8.1, and encountered an error where none of the Fleet pages in Kibana would load due to this error: image

The instance was fine prior to installing v2.11.0 and updating to Elastic v8.8.1.

I have deleted the policy via API and attempted to re-create it in the web UI, but we are encountering the same error. For reference we only have the Sophos XG Logs section of the integration enabled in this policy. image

Disabling the log integration and enabling one of the other sections (EG: TCP logs for XG) results in the policy creating without an error, so the issue lies within the logfile section and specifically with the XG logging.

I am not sure where to start with finding the root cause for the bad indentation mapping.

elasticmachine commented 1 year ago

Pinging @elastic/security-external-integrations (Team:Security-External Integrations)