Pin the Windows TA Version in Updater (#4203)

Author: pyth0n1c

.github/workflows/datasource-dependabot.yml

@@ -31,6 +31,11 @@ jobs:
         run: |
           echo "Updating data source supported_TA and repo install.yml app versions"
           contentctl-ng update-data-source-tas --content-dirs .
+          
+          # TODO: Remove this when we are fully compatible with the latest version of the Windows TA
+          # Temporarily roll back any automated updates to the Windows TA because we intentionally
+          # want to pin to the current version.
+          git checkout -- $(grep -rl "https://splunkbase.splunk.com/app/742" data_sources/)
           echo "Changed data source and install.yml files:"
           git status --short -- data_sources install.yml
 

data_sources/ntlm_operational_8004.yml

@@ -11,7 +11,7 @@ separator: EventCode
 supported_TA:
     - name: Splunk Add-on for Microsoft Windows
       url: https://splunkbase.splunk.com/app/742
-      version: 11.0.0
+      version: 10.0.1
 fields:
     - CategoryString
     - Channel

data_sources/ntlm_operational_8005.yml

@@ -11,7 +11,7 @@ separator: EventCode
 supported_TA:
     - name: Splunk Add-on for Microsoft Windows
       url: https://splunkbase.splunk.com/app/742
-      version: 11.0.0
+      version: 10.0.1
 fields:
     - CategoryString
     - Channel

data_sources/ntlm_operational_8006.yml

@@ -11,7 +11,7 @@ separator: EventCode
 supported_TA:
     - name: Splunk Add-on for Microsoft Windows
       url: https://splunkbase.splunk.com/app/742
-      version: 11.0.0
+      version: 10.0.1
 fields:
     - CategoryString
     - Channel

data_sources/powershell_script_block_logging_4104.yml

@@ -18,7 +18,7 @@ separator_value: '4104'
 supported_TA:
     - name: Splunk Add-on for Microsoft Windows
       url: https://splunkbase.splunk.com/app/742
-      version: 11.0.0
+      version: 10.0.1
 fields:
     - _time
     - ActivityID

data_sources/windows_active_directory_admon.yml

@@ -16,7 +16,7 @@ sourcetype: ActiveDirectory
 supported_TA:
     - name: Splunk Add-on for Microsoft Windows
       url: https://splunkbase.splunk.com/app/742
-      version: 11.0.0
+      version: 10.0.1
 fields:
     - _time
     - Guid

data_sources/windows_event_log_application_15457.yml

@@ -11,7 +11,7 @@ separator: EventCode
 supported_TA:
     - name: Splunk Add-on for Microsoft Windows
       url: https://splunkbase.splunk.com/app/742
-      version: 11.0.0
+      version: 10.0.1
 fields:
     - CategoryString
     - Channel

data_sources/windows_event_log_application_17135.yml

@@ -11,7 +11,7 @@ separator: EventCode
 supported_TA:
     - name: Splunk Add-on for Microsoft Windows
       url: https://splunkbase.splunk.com/app/742
-      version: 11.0.0
+      version: 10.0.1
 fields:
     - CategoryString
     - Channel

data_sources/windows_event_log_application_2282.yml

@@ -16,7 +16,7 @@ separator: EventCode
 supported_TA:
     - name: Splunk Add-on for Microsoft Windows
       url: https://splunkbase.splunk.com/app/742
-      version: 11.0.0
+      version: 10.0.1
 fields:
     - _time
     - Channel

data_sources/windows_event_log_application_3000.yml

@@ -17,7 +17,7 @@ separator_value: '3000'
 supported_TA:
     - name: Splunk Add-on for Microsoft Windows
       url: https://splunkbase.splunk.com/app/742
-      version: 11.0.0
+      version: 10.0.1
 fields:
     - _time
     - Channel