From 77d63f12ddfa0e69cdf63b2cd2a6676bedb0ab94 Mon Sep 17 00:00:00 2001
From: Roberto Dip <me@roperzh.com>
Date: Tue, 4 Apr 2023 08:39:35 -0300
Subject: [PATCH] fix TestGroupFromBytesWithWin10CISQueries (#10953)

Go tests are failing in main with:

```
=== RUN   TestGroupFromBytesWithWin10CISQueries
    spec_test.go:69:
        	Error Trace:	/Users/roperzh/fleet/pkg/spec/spec_test.go:69
        	Error:      	Received unexpected error:
        	            	failed to unmarshal spec item error converting YAML to JSON: yaml: line 20: mapping values are not allowed in this context:
        	            	apiVersion: v1
        	            	kind: policy
        	            	spec:
        	            	  name: CIS - Ensure 'Audit Other Object Access Events' is set to 'Success and Failure'
        	            	  platforms: win10
        	            	  platform: windows
        	            	  description: |
        	            	    This policy setting allows you to audit events generated by the management of task scheduler jobs or COM+ objects.
        	            	    For scheduler jobs, the following are audited:
        	            	      -  Job created.
        	            	      -  Job deleted.
        	            	      -  Job enabled.
        	            	      -  Job disabled.
        	            	      -  Job updated.
        	            	    For COM+ objects, the following are audited:
        	            	      -  Catalog object added.
        	            	      -  Catalog object updated.
        	            	      -  Catalog object deleted.
        	            	The recommended state for this setting is: Success and Failure.
        	            	  resolution: |
        	            	    Automatic method:
        	            	    Ask your system administrator to establish the recommended configuration via GP, set the following UI path to Success and Failure:
        	            	    'Computer Configuration\Policies\Windows Settings\Security Settings\Advanced Audit Policy Configuration\Audit Policies\Object Access\Audit Other Object Access Events'
        	            	  query: |
        	            	    SELECT 1 FROM mdm_bridge where mdm_command_input = "<SyncBody><Get><CmdID>1</CmdID><Item><Target><LocURI>./Device/Vendor/MSFT/Policy/Result/Audit/ObjectAccess_AuditOtherObjectAccessEvents</LocURI></Target></Item></Get></SyncBody>"
        	            	    AND mdm_command_output = 3;
        	            	  purpose: Informational
        	            	  tags: compliance, CIS, CIS_Level1, CIS_win10_enterprise_1.12.0, CIS_bullet_17.6.3
        	            	  contributors: sharon-fdm
        	Test:       	TestGroupFromBytesWithWin10CISQueries
--- FAIL: TestGroupFromBytesWithWin10CISQueries (0.31s)
```

This adds a missing indentation to make them pass.
---
 ee/cis/win-10/cis-policy-queries.yml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/ee/cis/win-10/cis-policy-queries.yml b/ee/cis/win-10/cis-policy-queries.yml
index 46d1442c9d..04bed269a3 100644
--- a/ee/cis/win-10/cis-policy-queries.yml
+++ b/ee/cis/win-10/cis-policy-queries.yml
@@ -3080,7 +3080,7 @@ spec:
       -  Catalog object added.
       -  Catalog object updated.
       -  Catalog object deleted.
-The recommended state for this setting is: Success and Failure.
+    The recommended state for this setting is: Success and Failure.
   resolution: |
     Automatic method:
     Ask your system administrator to establish the recommended configuration via GP, set the following UI path to Success and Failure: