Automated Splunk TA Update 168 - Failing Auth detection

[patel-bhavin]

This PR contains updates to Splunk TAs made by GitHub Actions workflow.

This detection is currently failing due to a bug in the Linux TA

Issue :

The TA version 10.0.0 is currently failing on one of the detections in ESCU that uses Authentication datamodel and relies on data with sourcetype = linux_secure - #3311:

Here is the detection

• We believe that the addition of AND NOT sourcetype=linux_secure to the eventtypes searches is causing some data to not be mapped correctly to the Authentication Datamodel.

What is the reason to add this - AND NOT sourcetype=linux_secure ?

What add-on version are you using?

10.0.0

[ljstella]

This is a distinct PR from #3307, although it appears to be updating the same app. Looks like this datasource was added yesterday: #3308 before 3307 was merged, so 3307 didn't have it in its base branch to update-

3308 did pass unit testing but now this is failing, potentially due to the app update.

[ljstella]

Looks like CIM mapping changed specifically for events from OpenSSH in v10.0 of this TA.

While successful logins are being mapped, our example failed login event in this test sample is not being mapped to Authentication.Failed_Authentications

[patel-bhavin]

Tracking this bug here: https://github.com/splunk/splunk-add-on-for-unix-and-linux/issues/608

[patel-bhavin]