filebeat: add SSL options to checkpoint module (elastic#19560)

* feat(firewall): add tls config

* feat(firewall): add vars to manifest

* chore(checkpoint): add tls to example

* chore(checkpoint): run mage fmt update

* cleanup(checkpoint): remove obsolete log_level

* refactor(checkpoint): move to .ssl

* chore(x-pack): revert ide fix

* chore(changelog): add f5 asm ref

* revert(changelog): remove f5 asm mod

* chore(changelog): add checkpoint tls

* chore: fix lint warnings

* Undo some changes and move docs to checkpoint

* Move changelog entry

Co-authored-by: Marc Guasch <marc.guasch@elastic.co>
(cherry picked from commit e29c3fa)

CHANGELOG.next.asciidoc

@@ -725,6 +725,7 @@ field. You can revert this change by configuring tags for the module and omittin
 - Adding support for FIPS in s3 input {pull}21446[21446]
 - Add max_number_of_messages config into s3 input. {pull}21993[21993]
 - Update Okta documentation for new stateful restarts. {pull}22091[22091]
+- Add SSL option to checkpoint module {pull}19560[19560]
 
 *Heartbeat*
 

filebeat/docs/modules/checkpoint.asciidoc

@@ -70,6 +70,18 @@ A list of tags to include in events. Including `forwarded` indicates that the
 events did not originate on this host and causes `host.name` to not be added to
 events. Defaults to `[checkpoint-firewall, forwarded]`.
 
+*`var.ssl`*::
+
+The SSL/TLS configuration for the filebeat instance. This can be used to enforce mutual TLS.
+```yaml
+ssl:
+  enabled: true
+  certificate_authorities: ["my-ca.pem"]
+  certificate: "filebeat-cert.pem"
+  key: "filebeat-key.pem"
+  client_authentication: "required"
+```
+
 [float]
 ==== Check Point devices
 

x-pack/filebeat/module/checkpoint/_meta/docs.asciidoc

@@ -65,6 +65,18 @@ A list of tags to include in events. Including `forwarded` indicates that the
 events did not originate on this host and causes `host.name` to not be added to
 events. Defaults to `[checkpoint-firewall, forwarded]`.
 
+*`var.ssl`*::
+
+The SSL/TLS configuration for the filebeat instance. This can be used to enforce mutual TLS.
+```yaml
+ssl:
+  enabled: true
+  certificate_authorities: ["my-ca.pem"]
+  certificate: "filebeat-cert.pem"
+  key: "filebeat-key.pem"
+  client_authentication: "required"
+```
+
 [float]
 ==== Check Point devices
 

x-pack/filebeat/module/checkpoint/firewall/config/firewall.yml

@@ -1,4 +1,10 @@
-{{ if eq .input "syslog" }}
+{{ if .ssl }}
+
+type: tcp
+host: "{{.syslog_host}}:{{.syslog_port}}"
+ssl: {{ .ssl | tojson }}
+
+{{ else if eq .input "syslog" }}
 
 type: udp
 host: "{{.syslog_host}}:{{.syslog_port}}"

x-pack/filebeat/module/checkpoint/firewall/manifest.yml

@@ -9,6 +9,7 @@ var:
     default: 9001
   - name: input
     default: syslog
+  - name: ssl
 
 ingest_pipeline:
   - ingest/pipeline.yml