[auditd_manager] Add audit rule files option to auditd_manager (#4905)

* Add audit rule files option to auditd_manager * Add PR number * Add constraints in template

Author: marc-gr

packages/auditd_manager/changelog.yml

@@ -1,4 +1,9 @@
 # newer versions go on top
+- version: "1.5.0"
+ changes:
+ - description: Add audit rule files option.
+ type: enhancement
+ link: https://github.com/elastic/integrations/pull/4905
 - version: "1.4.0"
  changes:
  - description: Update package to ECS 8.5.0.

packages/auditd_manager/data_stream/auditd/agent/stream/auditd.yml.hbs

@@ -11,7 +11,15 @@ immutable: {{immutable}}
 {{/if}}
 resolve_ids: {{resolve_ids}}
 failure_mode: {{failure_mode}}
+{{#if audit_rules}}
 audit_rules: {{escape_string audit_rules}}
+{{/if}}
+{{#if audit_rule_files.length}}
+audit_rule_files:
+{{#each audit_rule_files as |file i|}}
+ - {{file}}
+{{/each}}
+{{/if}}
 backlog_limit: {{backlog_limit}}
 rate_limit: {{rate_limit}}
 include_warnings: {{include_warnings}}

packages/auditd_manager/data_stream/auditd/manifest.yml

@@ -65,7 +65,7 @@ streams:
  - name: audit_rules
  type: textarea
  title: Audit rules
- required: true
+ required: false
  show_user: true
  description: |
  List of the audit rules that should be
@@ -74,6 +74,15 @@ streams:
  used by the Linux `auditctl` utility. `elastic-agent` supports adding file watches
  (`-w`) and syscall rules (`-a` or `-A`). For more information,
  see the integration detail page.
+ - name: audit_rule_files
+ type: text
+ title: Audit rule files
+ required: false
+ show_user: true
+ description: |
+ A list of files to load audit rules from. This files are loaded after the rules
+ declared in `Audit rules` are loaded. Wildcards are supported and will expand in
+ lexicographical order. The format is the same as that of the `Audit rules` field.
  - name: preserve_original_event
  required: true
  show_user: true

packages/auditd_manager/manifest.yml

@@ -1,7 +1,7 @@
 format_version: 1.0.0
 name: auditd_manager
 title: "Auditd Manager"
-version: "1.4.0"
+version: "1.5.0"
 release: ga
 license: basic
 description: "The Auditd Manager Integration receives audit events from the Linux Audit Framework that is a part of the Linux kernel."