Cherry-pick #18596 to 7.x: [Auditbeat] Update auditbeat ECS mappings

[andrewstucki]

Cherry-pick of PR #18596 to 7.x branch. Original message:

What does this PR do?

This is the spiritual successor to #18028 -- with the code to do the categorization itself moved into go-libaudit (see elastic/go-libaudit#62).

It adds in ECS categorization fields for a good chunk of auditd-based syscalls and event types.

Checklist

• My code follows the style guidelines of this project
• I have commented my code, particularly in hard-to-understand areas
• I have made corresponding changes to the documentation
• I have made corresponding change to the default configuration files
• I have added tests that prove my fix is effective or that my feature works
• I have added an entry in CHANGELOG.next.asciidoc or CHANGELOG-developer.next.asciidoc.

Related issues

• Relates [Auditbeat] Update OSS Audibeat auditd module to ECS 1.5 #17519

[elasticmachine]

Pinging @elastic/siem (Team:SIEM)

[elasticmachine]

💚 Build Succeeded

Expand to view the summary

Build stats

• Build Cause: [Pull request Cherry-pick #18596 to 7.x: [Auditbeat] Update auditbeat ECS mappings #18598 opened]

• Start Time: 2020-05-16T01:31:11.160+0000

• Duration: 76 min 1 sec (4561091)

Test stats 🧪

Test	Results
Failed	0
Passed	5891
Skipped	902
Total	6793

Steps errors

Expand to view the steps failures

• Name: Report to Codecov

  • Description: curl -sSLo codecov https://codecov.io/bash for i in auditbeat filebeat heartbeat libbeat metricbeat packetbeat winlogbeat journalbeat do FILE="${i}/build/coverage/full.cov" if [ -f "${FILE}" ]; then bash codecov -f "${FILE}" fi done

  • Result: FAILURE

  • Duration: 2 min 22 sec

  • Start Time: 2020-05-16T01:56:24.185+0000

  • log