Fixes known devices values absent in Sophos policy

[r00tu53r]

What does this PR do?

Fixes known devices values absent in Sophos policy

• YAML values entered into 'Known Devices' (known_devices) variable
  are absent in policy when assigning Sophos integration to policy.
• Embeds yaml value as an object instead of iterating over it.

Closes #1071

Checklist

• I have reviewed tips for building integrations and this pull request is aligned with them.
• I have verified that all data streams collect metrics or logs.
• I have added an entry to my package's changelog.yml file.

How to test this PR locally

elastic-package test system

Related issues

• Closes [Elastic-agent] Filebeat sopos-xg module, "Known Devices" values are not transferred to the policy. #1071

[elasticmachine]

Pinging @elastic/security-external-integrations (Team:Security-External Integrations)

[elasticmachine]

💚 Build Succeeded

the below badges are clickable and redirect to their specific view in the CI or DOCS

Expand to view the summary

Build stats

• Start Time: 2021-10-11T11:56:32.631+0000

• Duration: 24 min 59 sec

• Commit: ddd3521

Test stats 🧪

Test	Results
Failed	0
Passed	13
Skipped	0
Total	13

🤖 GitHub comments

To re-run your PR in the CI, just comment with:

• /test : Re-trigger the build.

[P1llus]

LGTM, but we should test if this actually works as well. Would you mind adding an example config in to the _dev/system folder for the xg datastream?

There should be a format like this there already:

data_stream:
  vars:
    paths:
      - "{{SERVICE_LOGS_DIR}}/sophos-xg*.log"

And under vars you can add your known_devices object you can add maybe 1-2 known_devices?

You can use the serial number: 1234567890123456 and S4000806149EE49 and 2 random example hostnames.

Example system test with variables:
https://github.com/elastic/integrations/blob/master/packages/microsoft_dhcp/data_stream/log/_dev/test/system/test-default-config.yml

[r00tu53r]

@P1llus Thanks. I have added known_devices to the system tests. Does this look okay? I ran the system tests they are passing.

[P1llus]

Looks good @r00tu53r , though I would have expected the output of the system test to also have become updated.
Did you generate new system output with (while elastic-package stack up -d -v):
elastic-package test system -v --generate

It should update the sample_event.json in the package

[r00tu53r]

Thanks again @P1llus I've added the generated sample event file. I see the known devices entry in there.

[P1llus]

All good to merge

[P1llus]

You need to run elastic-package build in the sophos folder to regenerate the readme, and add it to this commit, so that CI passes.