ssi_some: fix empty template evaluation to prevent updating fleet health status to degraded

packages/akamai/changelog.yml

@@ -1,4 +1,9 @@
 # newer versions go on top
+- version: "2.29.0"
+  changes:
+    - description: Prevent updating fleet health status to degraded.
+      type: enhancement
+      link: https://github.com/elastic/integrations/pull/15549
 - version: "2.28.0"
   changes:
     - description: Update Kibana constraint to support 9.0.0.

packages/akamai/data_stream/siem/agent/stream/httpjson.yml.hbs

@@ -20,14 +20,17 @@ request.transforms:
       target: url.params.from
       value: >-
         [[ if not (index .cursor "last_offset") ]][[ (now (parseDuration "-{{initial_interval}}")).Unix ]][[ end ]]
+      do_not_log_failure: true
   - set:
       target: url.params.to
       value: >- 
         [[ if not (index .cursor "last_offset") ]][[ (now).Unix ]][[ end ]]
+      do_not_log_failure: true
   - set:
       target: url.params.offset
       value: >-
         [[ if (index .cursor "last_offset") ]][[ .cursor.last_offset ]][[ end ]]
+      do_not_log_failure: true
 {{#if event_limit}}
   - set:
       target: url.params.limit
@@ -66,14 +69,16 @@ response.pagination:
       # as indicated by the 'total' field in the ResponseContext. This stops pagination.
       value: '[[ if not (eq (toInt .last_event.total) 0) ]][[ .last_event.offset ]][[ end ]]'
       fail_on_template_error: true
+      do_not_log_failure: true
   - delete:
       target: url.params.from
   - delete:
       target: url.params.to
 
 cursor:
   last_offset:
-    value: '[[ .last_event.offset ]]'
+    value: '[[ if index .last_event "offset" ]][[ .last_event.offset ]][[ end ]]'
+    ignore_empty_value: true
 
 {{#if tags.length}}
 tags:

packages/akamai/data_stream/siem/sample_event.json

@@ -1,11 +1,11 @@
 {
-    "@timestamp": "2016-08-11T13:45:33.026Z",
+    "@timestamp": "2025-10-02T09:58:03.000Z",
     "agent": {
-        "ephemeral_id": "9bba2ff8-f15b-4c09-8ac9-60ee0045a851",
-        "id": "cdda426a-7e47-48c4-b2f5-b9f1ad5bf08a",
-        "name": "docker-fleet-agent",
+        "ephemeral_id": "f1c53e1c-eb0e-4203-9eb8-3ad940c14ab6",
+        "id": "fb4e306d-b9f8-4886-8fd3-f66e408a4d69",
+        "name": "elastic-agent-71836",
         "type": "filebeat",
-        "version": "8.8.0"
+        "version": "8.19.4"
     },
     "akamai": {
         "siem": {
@@ -19,8 +19,8 @@
                 "sdk_version": "4.7.1",
                 "telemetry_type": 2
             },
-            "config_id": "6724",
-            "policy_id": "scoe_5426",
+            "config_id": "14227",
+            "policy_id": "qik1_26545",
             "request": {
                 "headers": {
                     "Accept": "text/html,application/xhtml xml",
@@ -29,6 +29,7 @@
             },
             "response": {
                 "headers": {
+                    "Content-Length": "150",
                     "Content-Type": "text/html",
                     "Mime-Version": "1.0",
                     "Server": "AkamaiGHost"
@@ -39,25 +40,34 @@
                 "deny"
             ],
             "rule_tags": [
-                "web_attack/xss",
-                "automation/misc"
+                "owasp_crs/web_attack/file_injection",
+                "owasp_crs/web_attack/command_inject"
             ],
             "rules": [
                 {
-                    "ruleActions": "ALERT",
-                    "ruleData": "alert(",
-                    "ruleMessages": "Cross-site Scripting (XSS) Attack",
-                    "ruleSelectors": "ARGS:a",
-                    "ruleTags": "WEB_ATTACK/XSS",
-                    "rules": "950004"
+                    "ruleActions": "alert",
+                    "ruleData": "telnet.exe",
+                    "ruleMessages": "System Command Access",
+                    "ruleSelectors": "ARGS:option",
+                    "ruleTags": "OWASP_CRS/WEB_ATTACK/FILE_INJECTION",
+                    "ruleVersions": "4",
+                    "rules": "950002"
                 },
                 {
-                    "ruleActions": "DENY",
-                    "ruleData": "curl",
-                    "ruleMessages": "Request Indicates an automated program explored the site",
-                    "ruleSelectors": "REQUEST_HEADERS:User-Agent",
-                    "ruleTags": "AUTOMATION/MISC",
-                    "rules": "990011"
+                    "ruleActions": "alert",
+                    "ruleData": "telnet.exe",
+                    "ruleMessages": "System Command Injection",
+                    "ruleSelectors": "ARGS:option",
+                    "ruleTags": "OWASP_CRS/WEB_ATTACK/COMMAND_INJECT",
+                    "ruleVersions": "4",
+                    "rules": "950006"
+                },
+                {
+                    "ruleActions": "deny",
+                    "ruleData": "Vector Score: 10, DENY threshold: 9, Ale",
+                    "ruleMessages": "Anomaly Score Exceeded fo",
+                    "ruleVersions": "1",
+                    "rules": "CMD-INJECTION-ANOMALY"
                 }
             ],
             "user_risk": {
@@ -103,40 +113,40 @@
     },
     "data_stream": {
         "dataset": "akamai.siem",
-        "namespace": "ep",
+        "namespace": "12672",
         "type": "logs"
     },
     "ecs": {
         "version": "8.11.0"
     },
     "elastic_agent": {
-        "id": "cdda426a-7e47-48c4-b2f5-b9f1ad5bf08a",
-        "snapshot": true,
-        "version": "8.8.0"
+        "id": "fb4e306d-b9f8-4886-8fd3-f66e408a4d69",
+        "snapshot": false,
+        "version": "8.19.4"
     },
     "event": {
         "agent_id_status": "verified",
         "category": [
             "network"
         ],
-        "created": "2023-05-09T21:06:11.267Z",
+        "created": "2025-10-03T09:53:03.298Z",
         "dataset": "akamai.siem",
-        "id": "2ab418ac8515f33",
-        "ingested": "2023-05-09T21:06:12Z",
+        "id": "186aa424f05cee00",
+        "ingested": "2025-10-03T09:53:05Z",
         "kind": "event",
-        "original": "{\"attackData\":{\"clientIP\":\"89.160.20.156\",\"configId\":\"6724\",\"policyId\":\"scoe_5426\",\"ruleActions\":\"QUxFUlQ;REVOWQ==\",\"ruleData\":\"YWxlcnQo;Y3VybA==\",\"ruleMessages\":\"Q3Jvc3Mtc2l0ZSBTY3 JpcHRpbmcgKFhTUykgQXR0YWNr; UmVxdWVzdCBJbmRpY2F0ZXMgYW4 gYXV0b21hdGVkIHByb2 dyYW0gZXhwbG9yZWQgdGhlIHNpdGU=\",\"ruleSelectors\":\"QVJHUzph;UkVRVUVTVF9IRU FERVJTOlVzZXItQWdlbnQ=\",\"ruleTags\":\"V0VCX0FUVEFDSy9YU1M=;QV VUT01BVElPTi9NSVND\",\"ruleVersions\":\";\",\"rules\":\"OTUwMDA0;OTkwMDEx\"},\"botData\":{\"botScore\":\"100\",\"responseSegment\":\"3\"},\"clientData\":{\"appBundleId\":\"com.mydomain.myapp\",\"appVersion\":\"1.23\",\"sdkVersion\":\"4.7.1\",\"telemetryType\":\"2\"},\"format\":\"json\",\"geo\":{\"asn\":\"12271\",\"city\":\"NEWYORK\",\"continent\":\"NA\",\"country\":\"US\",\"regionCode\":\"NY\"},\"httpMessage\":{\"bytes\":\"34523\",\"host\":\"www.example.com\",\"method\":\"POST\",\"path\":\"/examples/1/\",\"port\":\"80\",\"protocol\":\"http/2\",\"query\":\"a%3D..%2F..%2F..%2Fetc%2Fpasswd\",\"requestHeaders\":\"User-Agent%3a%20BOT%2f0.1%20(BOT%20for%20JCE)%0d%0aAccept%3a%20text%2fhtml,application%2fxhtml+xml\",\"requestId\":\"2ab418ac8515f33\",\"responseHeaders\":\"Server%3a%20AkamaiGHost%0d%0aMime-Version%3a%201.0%0d%0aContent-Type%3a%20text%2fhtml\",\"start\":\"1470923133.026\",\"status\":\"301\",\"tls\":\"TLSv1.2\"},\"type\":\"akamai_siem\",\"userRiskData\":{\"allow\":\"0\",\"general\":\"duc_1h:10|duc_1d:30\",\"risk\":\"udfp:1325gdg4g4343g/M|unp:74256/H\",\"score\":\"75\",\"status\":\"0\",\"trust\":\"ugp:US\",\"uuid\":\"964d54b7-0821-413a-a4d6-8131770ec8d5\"},\"version\":\"1.0\"}",
-        "start": "2016-08-11T13:45:33.026Z"
+        "original": "{\"attackData\":{\"clientIP\":\"89.160.20.156\",\"configId\":\"14227\",\"policyId\":\"qik1_26545\",\"ruleActions\":\"YWxlcnQ%3d%3bYWxlcnQ%3d%3bZGVueQ%3d%3d\",\"ruleData\":\"dGVsbmV0LmV4ZQ%3d%3d%3bdGVsbmV0LmV4ZQ%3d%3d%3bVmVjdG9yIFNjb3JlOiAxMCwgREVOWSB0aHJlc2hvbGQ6IDksIEFsZX \",\"ruleMessages\":\"U3lzdGVtIENvbW1hbmQgQWNjZXNz%3bU3lzdGVtIENvbW1hbmQgSW5qZWN0aW9u%3bQW5vbWFseSBTY29yZSBFeGNlZWRlZCBmb3 \",\"ruleSelectors\":\"QVJHUzpvcHRpb24%3d%3bQVJHUzpvcHRpb24%3d%3b\",\"ruleTags\":\"T1dBU1BfQ1JTL1dFQl9BVFRBQ0svRklMRV9JTkpFQ1RJT04%3d%3bT1dBU1BfQ1JTL1dFQl9BVFRBQ0svQ09NTUFORF9JTkpFQ1R \",\"ruleVersions\":\"NA%3d%3d%3bNA%3d%3d%3bMQ%3d%3d\",\"rules\":\"OTUwMDAy%3bOTUwMDA2%3bQ01ELUlOSkVDVElPTi1BTk9NQUxZ\"},\"botData\":{\"botScore\":\"100\",\"responseSegment\":\"3\"},\"clientData\":{\"appBundleId\":\"com.mydomain.myapp\",\"appVersion\":\"1.23\",\"sdkVersion\":\"4.7.1\",\"telemetryType\":\"2\"},\"format\":\"json\",\"geo\":{\"asn\":\"14618\",\"city\":\"ASHBURN\",\"continent\":\"288\",\"country\":\"US\",\"regionCode\":\"VA\"},\"httpMessage\":{\"bytes\":\"266\",\"host\":\"www.hmapi.com\",\"method\":\"GET\",\"path\":\"/\",\"port\":\"80\",\"protocol\":\"HTTP/1.1\",\"query\":\"option=com_jce%20telnet.exe\",\"requestHeaders\":\"User-Agent%3a%20BOT%2f0.1%20(BOT%20for%20JCE)%0d%0aAccept%3a%20text%2fhtml,application%2fxhtml+xml\",\"requestId\":\"186aa424f05cee00\",\"responseHeaders\":\"Server%3a%20AkamaiGHost%0d%0aMime-Version%3a%201.0%0d%0aContent-Type%3a%20text%2fhtml%0d%0aContent-Length%3a%20150\",\"start\":1759399083,\"status\":\"200\"},\"type\":\"akamai_siem\",\"userRiskData\":{\"allow\":\"0\",\"general\":\"duc_1h:10|duc_1d:30\",\"risk\":\"udfp:1325gdg4g4343g/M|unp:74256/H\",\"score\":\"75\",\"status\":\"0\",\"trust\":\"ugp:US\",\"uuid\":\"964d54b7-0821-413a-a4d6-8131770ec8d5\"},\"version\":\"1.0\"}",
+        "start": "2025-10-02T09:58:03.000Z"
     },
     "http": {
         "request": {
-            "id": "2ab418ac8515f33",
-            "method": "POST"
+            "id": "186aa424f05cee00",
+            "method": "GET"
         },
         "response": {
-            "bytes": 34523,
-            "status_code": 301
+            "bytes": 266,
+            "status_code": 200
         },
-        "version": "2"
+        "version": "1.1"
     },
     "input": {
         "type": "httpjson"
@@ -181,15 +191,11 @@
         "forwarded",
         "preserve_original_event"
     ],
-    "tls": {
-        "version": "1.2",
-        "version_protocol": "tls"
-    },
     "url": {
-        "domain": "www.example.com",
-        "full": "www.example.com/examples/1/?a%3D..%2F..%2F..%2Fetc%2Fpasswd",
-        "path": "/examples/1/",
+        "domain": "www.hmapi.com",
+        "full": "www.hmapi.com/?option=com_jce%20telnet.exe",
+        "path": "/",
         "port": 80,
-        "query": "a=../../../etc/passwd"
+        "query": "option=com_jce telnet.exe"
     }
-}
+}

packages/akamai/docs/README.md

@@ -74,13 +74,13 @@ An example event for `siem` looks as following:
 
 ```json
 {
-    "@timestamp": "2016-08-11T13:45:33.026Z",
+    "@timestamp": "2025-10-02T09:58:03.000Z",
     "agent": {
-        "ephemeral_id": "9bba2ff8-f15b-4c09-8ac9-60ee0045a851",
-        "id": "cdda426a-7e47-48c4-b2f5-b9f1ad5bf08a",
-        "name": "docker-fleet-agent",
+        "ephemeral_id": "f1c53e1c-eb0e-4203-9eb8-3ad940c14ab6",
+        "id": "fb4e306d-b9f8-4886-8fd3-f66e408a4d69",
+        "name": "elastic-agent-71836",
         "type": "filebeat",
-        "version": "8.8.0"
+        "version": "8.19.4"
     },
     "akamai": {
         "siem": {
@@ -94,8 +94,8 @@ An example event for `siem` looks as following:
                 "sdk_version": "4.7.1",
                 "telemetry_type": 2
             },
-            "config_id": "6724",
-            "policy_id": "scoe_5426",
+            "config_id": "14227",
+            "policy_id": "qik1_26545",
             "request": {
                 "headers": {
                     "Accept": "text/html,application/xhtml xml",
@@ -104,6 +104,7 @@ An example event for `siem` looks as following:
             },
             "response": {
                 "headers": {
+                    "Content-Length": "150",
                     "Content-Type": "text/html",
                     "Mime-Version": "1.0",
                     "Server": "AkamaiGHost"
@@ -114,25 +115,34 @@ An example event for `siem` looks as following:
                 "deny"
             ],
             "rule_tags": [
-                "web_attack/xss",
-                "automation/misc"
+                "owasp_crs/web_attack/file_injection",
+                "owasp_crs/web_attack/command_inject"
             ],
             "rules": [
                 {
-                    "ruleActions": "ALERT",
-                    "ruleData": "alert(",
-                    "ruleMessages": "Cross-site Scripting (XSS) Attack",
-                    "ruleSelectors": "ARGS:a",
-                    "ruleTags": "WEB_ATTACK/XSS",
-                    "rules": "950004"
+                    "ruleActions": "alert",
+                    "ruleData": "telnet.exe",
+                    "ruleMessages": "System Command Access",
+                    "ruleSelectors": "ARGS:option",
+                    "ruleTags": "OWASP_CRS/WEB_ATTACK/FILE_INJECTION",
+                    "ruleVersions": "4",
+                    "rules": "950002"
                 },
                 {
-                    "ruleActions": "DENY",
-                    "ruleData": "curl",
-                    "ruleMessages": "Request Indicates an automated program explored the site",
-                    "ruleSelectors": "REQUEST_HEADERS:User-Agent",
-                    "ruleTags": "AUTOMATION/MISC",
-                    "rules": "990011"
+                    "ruleActions": "alert",
+                    "ruleData": "telnet.exe",
+                    "ruleMessages": "System Command Injection",
+                    "ruleSelectors": "ARGS:option",
+                    "ruleTags": "OWASP_CRS/WEB_ATTACK/COMMAND_INJECT",
+                    "ruleVersions": "4",
+                    "rules": "950006"
+                },
+                {
+                    "ruleActions": "deny",
+                    "ruleData": "Vector Score: 10, DENY threshold: 9, Ale",
+                    "ruleMessages": "Anomaly Score Exceeded fo",
+                    "ruleVersions": "1",
+                    "rules": "CMD-INJECTION-ANOMALY"
                 }
             ],
             "user_risk": {
@@ -178,40 +188,40 @@ An example event for `siem` looks as following:
     },
     "data_stream": {
         "dataset": "akamai.siem",
-        "namespace": "ep",
+        "namespace": "12672",
         "type": "logs"
     },
     "ecs": {
         "version": "8.11.0"
     },
     "elastic_agent": {
-        "id": "cdda426a-7e47-48c4-b2f5-b9f1ad5bf08a",
-        "snapshot": true,
-        "version": "8.8.0"
+        "id": "fb4e306d-b9f8-4886-8fd3-f66e408a4d69",
+        "snapshot": false,
+        "version": "8.19.4"
     },
     "event": {
         "agent_id_status": "verified",
         "category": [
             "network"
         ],
-        "created": "2023-05-09T21:06:11.267Z",
+        "created": "2025-10-03T09:53:03.298Z",
         "dataset": "akamai.siem",
-        "id": "2ab418ac8515f33",
-        "ingested": "2023-05-09T21:06:12Z",
+        "id": "186aa424f05cee00",
+        "ingested": "2025-10-03T09:53:05Z",
         "kind": "event",
-        "original": "{\"attackData\":{\"clientIP\":\"89.160.20.156\",\"configId\":\"6724\",\"policyId\":\"scoe_5426\",\"ruleActions\":\"QUxFUlQ;REVOWQ==\",\"ruleData\":\"YWxlcnQo;Y3VybA==\",\"ruleMessages\":\"Q3Jvc3Mtc2l0ZSBTY3 JpcHRpbmcgKFhTUykgQXR0YWNr; UmVxdWVzdCBJbmRpY2F0ZXMgYW4 gYXV0b21hdGVkIHByb2 dyYW0gZXhwbG9yZWQgdGhlIHNpdGU=\",\"ruleSelectors\":\"QVJHUzph;UkVRVUVTVF9IRU FERVJTOlVzZXItQWdlbnQ=\",\"ruleTags\":\"V0VCX0FUVEFDSy9YU1M=;QV VUT01BVElPTi9NSVND\",\"ruleVersions\":\";\",\"rules\":\"OTUwMDA0;OTkwMDEx\"},\"botData\":{\"botScore\":\"100\",\"responseSegment\":\"3\"},\"clientData\":{\"appBundleId\":\"com.mydomain.myapp\",\"appVersion\":\"1.23\",\"sdkVersion\":\"4.7.1\",\"telemetryType\":\"2\"},\"format\":\"json\",\"geo\":{\"asn\":\"12271\",\"city\":\"NEWYORK\",\"continent\":\"NA\",\"country\":\"US\",\"regionCode\":\"NY\"},\"httpMessage\":{\"bytes\":\"34523\",\"host\":\"www.example.com\",\"method\":\"POST\",\"path\":\"/examples/1/\",\"port\":\"80\",\"protocol\":\"http/2\",\"query\":\"a%3D..%2F..%2F..%2Fetc%2Fpasswd\",\"requestHeaders\":\"User-Agent%3a%20BOT%2f0.1%20(BOT%20for%20JCE)%0d%0aAccept%3a%20text%2fhtml,application%2fxhtml+xml\",\"requestId\":\"2ab418ac8515f33\",\"responseHeaders\":\"Server%3a%20AkamaiGHost%0d%0aMime-Version%3a%201.0%0d%0aContent-Type%3a%20text%2fhtml\",\"start\":\"1470923133.026\",\"status\":\"301\",\"tls\":\"TLSv1.2\"},\"type\":\"akamai_siem\",\"userRiskData\":{\"allow\":\"0\",\"general\":\"duc_1h:10|duc_1d:30\",\"risk\":\"udfp:1325gdg4g4343g/M|unp:74256/H\",\"score\":\"75\",\"status\":\"0\",\"trust\":\"ugp:US\",\"uuid\":\"964d54b7-0821-413a-a4d6-8131770ec8d5\"},\"version\":\"1.0\"}",
-        "start": "2016-08-11T13:45:33.026Z"
+        "original": "{\"attackData\":{\"clientIP\":\"89.160.20.156\",\"configId\":\"14227\",\"policyId\":\"qik1_26545\",\"ruleActions\":\"YWxlcnQ%3d%3bYWxlcnQ%3d%3bZGVueQ%3d%3d\",\"ruleData\":\"dGVsbmV0LmV4ZQ%3d%3d%3bdGVsbmV0LmV4ZQ%3d%3d%3bVmVjdG9yIFNjb3JlOiAxMCwgREVOWSB0aHJlc2hvbGQ6IDksIEFsZX \",\"ruleMessages\":\"U3lzdGVtIENvbW1hbmQgQWNjZXNz%3bU3lzdGVtIENvbW1hbmQgSW5qZWN0aW9u%3bQW5vbWFseSBTY29yZSBFeGNlZWRlZCBmb3 \",\"ruleSelectors\":\"QVJHUzpvcHRpb24%3d%3bQVJHUzpvcHRpb24%3d%3b\",\"ruleTags\":\"T1dBU1BfQ1JTL1dFQl9BVFRBQ0svRklMRV9JTkpFQ1RJT04%3d%3bT1dBU1BfQ1JTL1dFQl9BVFRBQ0svQ09NTUFORF9JTkpFQ1R \",\"ruleVersions\":\"NA%3d%3d%3bNA%3d%3d%3bMQ%3d%3d\",\"rules\":\"OTUwMDAy%3bOTUwMDA2%3bQ01ELUlOSkVDVElPTi1BTk9NQUxZ\"},\"botData\":{\"botScore\":\"100\",\"responseSegment\":\"3\"},\"clientData\":{\"appBundleId\":\"com.mydomain.myapp\",\"appVersion\":\"1.23\",\"sdkVersion\":\"4.7.1\",\"telemetryType\":\"2\"},\"format\":\"json\",\"geo\":{\"asn\":\"14618\",\"city\":\"ASHBURN\",\"continent\":\"288\",\"country\":\"US\",\"regionCode\":\"VA\"},\"httpMessage\":{\"bytes\":\"266\",\"host\":\"www.hmapi.com\",\"method\":\"GET\",\"path\":\"/\",\"port\":\"80\",\"protocol\":\"HTTP/1.1\",\"query\":\"option=com_jce%20telnet.exe\",\"requestHeaders\":\"User-Agent%3a%20BOT%2f0.1%20(BOT%20for%20JCE)%0d%0aAccept%3a%20text%2fhtml,application%2fxhtml+xml\",\"requestId\":\"186aa424f05cee00\",\"responseHeaders\":\"Server%3a%20AkamaiGHost%0d%0aMime-Version%3a%201.0%0d%0aContent-Type%3a%20text%2fhtml%0d%0aContent-Length%3a%20150\",\"start\":1759399083,\"status\":\"200\"},\"type\":\"akamai_siem\",\"userRiskData\":{\"allow\":\"0\",\"general\":\"duc_1h:10|duc_1d:30\",\"risk\":\"udfp:1325gdg4g4343g/M|unp:74256/H\",\"score\":\"75\",\"status\":\"0\",\"trust\":\"ugp:US\",\"uuid\":\"964d54b7-0821-413a-a4d6-8131770ec8d5\"},\"version\":\"1.0\"}",
+        "start": "2025-10-02T09:58:03.000Z"
     },
     "http": {
         "request": {
-            "id": "2ab418ac8515f33",
-            "method": "POST"
+            "id": "186aa424f05cee00",
+            "method": "GET"
         },
         "response": {
-            "bytes": 34523,
-            "status_code": 301
+            "bytes": 266,
+            "status_code": 200
         },
-        "version": "2"
+        "version": "1.1"
     },
     "input": {
         "type": "httpjson"
@@ -256,16 +266,12 @@ An example event for `siem` looks as following:
         "forwarded",
         "preserve_original_event"
     ],
-    "tls": {
-        "version": "1.2",
-        "version_protocol": "tls"
-    },
     "url": {
-        "domain": "www.example.com",
-        "full": "www.example.com/examples/1/?a%3D..%2F..%2F..%2Fetc%2Fpasswd",
-        "path": "/examples/1/",
+        "domain": "www.hmapi.com",
+        "full": "www.hmapi.com/?option=com_jce%20telnet.exe",
+        "path": "/",
         "port": 80,
-        "query": "a=../../../etc/passwd"
+        "query": "option=com_jce telnet.exe"
     }
 }
 ```

packages/akamai/manifest.yml

@@ -1,13 +1,13 @@
 name: akamai
 title: Akamai
-version: "2.28.0"
+version: "2.29.0"
 description: Collect logs from Akamai with Elastic Agent.
 type: integration
 format_version: "3.0.2"
 categories: [security, cdn_security]
 conditions:
   kibana:
-    version: "^8.13.0 || ^9.0.0"
+    version: "^8.19.4 || ^9.0.7"
 icons:
   - src: /img/akamai_logo.svg
     title: Akamai

packages/bitwarden/changelog.yml

@@ -1,4 +1,9 @@
 # newer versions go on top
+- version: "1.18.0"
+  changes:
+    - description: Prevent updating fleet health status to degraded.
+      type: enhancement
+      link: https://github.com/elastic/integrations/pull/15549
 - version: "1.17.0"
   changes:
     - description: Update Kibana constraint to support 9.0.0.