[8.19](backport #44909) [Filebeat] Do not run o365audit input and o365 module in FIPS builds

x-pack/filebeat/input/o365audit/input.go

@@ -65,6 +65,13 @@
 			Type:       pluginName,
 			Configure:  configure,
 		},
+
+		// ExcludeFromFIPS = true to prevent this input from being used in FIPS-capable
+		// Filebeat distributions.  This input indirectly uses algorithms that are not
+		// FIPS-compliant. Specifically, the input depends on the
+		// github.com/Azure/azure-sdk-for-go/sdk/azidentity package which, in turn,
+		// depends on the golang.org/x/crypto/pkcs12 package, which is not FIPS-compliant.
+		ExcludeFromFIPS: true,
 	}
 }
 
@@ -94,7 +101,7 @@
 func (inp *o365input) Name() string { return pluginName }
 
 func (inp *o365input) Test(src cursor.Source, ctx v2.TestContext) error {
 	tenantID := src.(*stream).tenantID
 	auth, err := inp.config.NewTokenProvider(tenantID)
 	if err != nil {
 		return err
@@ -118,7 +125,7 @@
 		if err == nil {
 			break
 		}
 		if ctx.Cancelation.Err() != err && err != context.Canceled {
 			msg := mapstr.M{}
 			msg.Put("error.message", err.Error())
 			msg.Put("event.kind", "pipeline_error")
@@ -126,10 +133,10 @@
 				Timestamp: time.Now(),
 				Fields:    msg,
 			}
 			publisher.Publish(event, nil)
 			ctx.Logger.Errorf("Input failed: %v", err)
 			ctx.Logger.Infof("Restarting in %v", inp.config.API.ErrorRetryInterval)
 			timed.Wait(ctx.Cancelation, inp.config.API.ErrorRetryInterval)
 		}
 	}
 	return nil
@@ -141,7 +148,7 @@
 	cursor cursor.Cursor,
 	publisher cursor.Publisher,
 ) error {
 	stream := src.(*stream)
 	tenantID, contentType := stream.tenantID, stream.contentType
 	log := v2ctx.Logger.With("tenantID", tenantID, "contentType", contentType)
 	ctx := ctxtool.FromCanceller(v2ctx.Cancelation)
@@ -259,14 +266,14 @@
 		}
 	}
 	if env.Config.PreserveOriginalEvent {
 		b.PutValue("event.original", string(raw))
 	}
 	if len(errs) > 0 {
 		msgs := make([]string, len(errs))
 		for idx, e := range errs {
 			msgs[idx] = e.Error()
 		}
 		b.PutValue("error.message", msgs)
 	}
 	return b
 }

x-pack/filebeat/module/o365/_meta/docs.asciidoc

@@ -5,6 +5,8 @@
 
 == Office 365 module
 
+WARNING: This module is not available in FIPS-capable Filebeat.
+
 beta[]
 
 include::{libbeat-dir}/shared/integration-link.asciidoc[]