[33 integrations] Downgrade format_version if possible

[chrisberkhout]

The listed integrations use (packapge spec) format_version: 3.4.0, so they are not available in Kibana 9.0.x.

They should be downgraded to a 3.X.X version unless they require functionality in package-spec 3.4.0.

Related resources

• elastic-package README sections regarding version compatibility
• Guidelines for the format version to use in a package
  • PR Update format_version.md elastic-package#2867 updates that to be consistent with the advice:

    It is actually recommended to use the minimum spec version that support all the features that the package needs.

Integrations

• abnormal_security
• armis
• authentik
• beyondinsight_password_safe
• beyondtrust_pra
• carbon_black_cloud {mimecast, carbon_black_cloud}: Add processor to remove the fields added by the agentless policy #15220
• checkpoint_email [Checkpoint Email] Add agentless deployment #15450
• claroty_ctd
• claroty_xdome
• cyberark_epm
• docker_otel
• extrahop
• first_epss
• google_secops
• imperva_cloud_waf
• microsoft_sentinel
• mimecast {mimecast, carbon_black_cloud}: Add processor to remove the fields added by the agentless policy #15220
• nozomi_networks
• proofpoint_itm
• qualys_gav
• security_ai_prompts
• servicenow
• splunk
• spycloud
• statsd_input [statsd_input] Make StatsD input package GA #15125
• sublime_security
• sysdig [sysdig] Add support for cspm datastream #14907
• system_otel
• ti_custom
• ti_domaintools
• ti_google_threat_intelligence
• ti_greynoise
• ti_recordedfuture
• vectra_rux
• wiz

[elasticmachine]

Pinging @elastic/security-service-integrations (Team:Security-Service Integrations)

[mykola-elastic]

Downgrading statsd_input format_version to 3.0.4 in PR: #15125

[kcreddy]

Downgrading mimecast and carbon_black_cloud to 3.3.2 in PR: #15220
@chrisberkhout, these integrations are not in the list. Please add them as they are done in #15110 and #15124 likely after this issue is created.

[brijesh-elastic]

This PR will downgrade the format_version as possible.
The following integrations have not been changed because they are owned by other teams and might require format_version: 3.4.x

• docker_otel
• security_ai_prompts
• system_otel