[production] Promote packages from snapshot (carbon_black_cloud-1.0.3, cef-2.0.3, checkpoint-1.5.1, cisco_asa-2.4.2, cisco_ftd-2.2.2, gcp-1.9.2, github-1.0.2, httpjson-1.2.4, o365-1.6.0, snyk-1.2.1, tenable_sc-1.2.2, winlog-1.5.2)

packages/carbon_black_cloud/1.0.3/changelog.yml

@@ -0,0 +1,36 @@
+# newer versions go on top
+- version: "1.0.3"
+  changes:
+    - description: Add correct field mapping for event.created
+      type: bugfix
+      link: https://github.com/elastic/integrations/issues/3579
+- version: "1.0.2"
+  changes:
+    - description: Fix dashboard issues.
+      type: bugfix
+      link: https://github.com/elastic/integrations/issues/3462
+- version: "1.0.1"
+  changes:
+    - description: Change event.outcome value from failure to failed according to ECS
+      type: bugfix
+      link: https://github.com/elastic/integrations/issues/3407
+- version: "1.0.0"
+  changes:
+    - description: Make GA
+      type: enhancement
+      link: https://github.com/elastic/integrations/pull/3428
+- version: 0.1.2
+  changes:
+    - description: Add "VMware" to the title to make it "VMware Carbon Black Cloud".
+      type: enhancement
+      link: https://github.com/elastic/integrations/pull/3196
+- version: 0.1.1
+  changes:
+    - description: Captured domain from username and hostname
+      type: enhancement
+      link: https://github.com/elastic/integrations/pull/3106
+- version: 0.1.0
+  changes:
+    - description: Initial draft of the package.
+      type: enhancement
+      link: https://github.com/elastic/integrations/pull/2760

packages/carbon_black_cloud/1.0.3/data_stream/alert/agent/stream/aws-s3.yml.hbs

@@ -0,0 +1,24 @@
+bucket_arn: {{bucket_arn}}
+number_of_workers: {{number_of_workers}}
+bucket_list_interval: {{interval}}
+access_key_id: {{access_key_id}}
+secret_access_key: {{secret_access_key}}
+bucket_list_prefix: {{bucket_list_prefix}}
+expand_event_list_from_field: Records
+{{#if proxy_url}}
+proxy_url: {{proxy_url}}
+{{/if}}
+tags:
+{{#if preserve_original_event}}
+  - preserve_original_event
+{{/if}}
+{{#each tags as |tag|}}
+  - {{tag}}
+{{/each}}
+{{#contains "forwarded" tags}}
+publisher_pipeline.disable_host: true
+{{/contains}}
+{{#if processors}}
+processors:
+{{processors}}
+{{/if}}

packages/carbon_black_cloud/1.0.3/data_stream/alert/agent/stream/httpjson.yml.hbs

@@ -0,0 +1,52 @@
+config_version: 2
+interval: {{interval}}
+request.timeout: 2m
+request.method: POST
+
+{{#if proxy_url}}
+request.proxy_url: {{proxy_url}}
+{{/if}}
+{{#if ssl}}
+request.ssl: {{ssl}}
+{{/if}}
+
+request.url: {{hostname}}/appservices/v6/orgs/{{org_key}}/alerts/_search
+request.transforms:
+  - set:
+      target: header.X-Auth-Token
+      value: {{custom_api_secret_key}}/{{custom_api_id}}
+  - set:
+      target: body.criteria.last_update_time.start
+      value: '[[.cursor.last_update_timestamp]]'
+      default: '[[formatDate ((now (parseDuration "-{{initial_interval}}")).Add (parseDuration "-15m")) "RFC3339"]]'
+  - set:
+      target: body.criteria.last_update_time.end
+      value: '[[formatDate (now (parseDuration "-15m")) "RFC3339"]]'
+  - set:
+      target: body.sort
+      value: '[{ "field": "last_update_time", "order": "ASC"}]'
+      value_type: json
+response.pagination: 
+  - set:
+      target: body.criteria.last_update_time.start
+      value: '[[if (ne .last_response.body.num_found .last_response.body.num_available)]][[.last_event.last_update_time]][[else]][[.last_response.terminate_pagination]][[end]]'
+      fail_on_template_error: true
+cursor:
+  last_update_timestamp:
+    value: '[[.last_event.last_update_time]]'
+response.split:
+  target: body.results
+tags:
+{{#if preserve_original_event}}
+  - preserve_original_event
+{{/if}}
+{{#each tags as |tag|}}
+  - {{tag}}
+{{/each}}
+{{#contains "forwarded" tags}}
+publisher_pipeline.disable_host: true
+{{/contains}}
+{{#if processors}}
+processors:
+{{processors}}
+{{/if}}