add 8.12 custom documentation

[ferullo]

All changes are in custom_documentation/. These are the additions for 8.12.

When I ran make clean all to re-render the markdown custom documentation I got a bunch of file changes in package/endpoint/data_stream/*fields/fields.yml I can't explain. I did not commit them, since this PR is just mean to touch custom_documentation/. The changes seemed formatting related, I assume it's just a matter of my golang version/dependencies.

[gabriellandau]

Should we PR 8.12 into main? https://github.com/elastic/endpoint-package/compare/main...8.12?expand=1

[ferullo]

Should we PR 8.12 into main?

IDK. That's not related to this PR (which has been tested against an 8.12 Endpoint -- it's ok this merges to main and not 8.12 in this repo).

It looks like @jdu2600 @AsuNa-jp and @intxgo are able to answer your question.

[intxgo]

@ferullo I'm not sure what did you do. Did you tested and fixed the custom documentation on endpoint-package/8.12 using 8.12 Endpoint, or did you do it on endpoint-package/main using 8.12 Endpoint?

I have the same question about endpoint-package as @gabriellandau. 8.12 branch has more new commits than main. How do we maintain branches in this repo, in reverse logic just like in endpoint-dev? but I agree, merging branches is not related to this PR.

[ferullo]

@ferullo I'm not sure what did you do. Did you tested and fixed the custom documentation on endpoint-package/8.12 using 8.12 Endpoint, or did you do it on endpoint-package/main using 8.12 Endpoint?

The latter. This is what I've done in the past too. That's where the link ("... refer to the Endpoint event documentation.") on https://www.elastic.co/guide/en/security/master/siem-field-reference.html points. I'm not going to merge the endpoint PR used to test/generate these updates so this discrepancy won't create any merge problems.

I have the same question about endpoint-package as @gabriellandau. 8.12 branch has more new commits than main. How do we maintain branches in this repo, in reverse logic just like in endpoint-dev? but I agree, merging branches is not related to this PR.

@pzl can you answer that?

[pzl]

The general case for branching is that everything merges into main, and is backported to release branches.

Making a release branch is usually just branching off from main during release time, and 2-3 commits are made to the release branch for the actual process of marking versions, then preparing a -dev version for any patch-release work that branch may receive.

In this particular instance, we had a rather large breaking change, that was significant work to revert (across several PRs), so main and 8.12 diverged for a while to unblock kibana (this affected all CI runs) while continuing to test and recover the feature in main. It ended up being reverted from both after a while.

In the general case we do not merge anything from release branches back into main. There are version-specific commits we make during the branch cutting that should not pull into main. And certainly for 8.12 that had some emergency recovery work that shouldn't apply to main.

---

I got a bunch of file changes in package/endpoint/data_stream/*fields/fields.yml I can't explain

CI runs make on all PRs and checks for any uncommitted changes. If CI is not picking up on anything, then it might just be inconsequential formatting, or yes, some go vendor dependency stuff. CI is generally very noisy about picking up true positives for uncomitted things, so a green is fairly reassuring to me. I will fix any formatting or tool version things upstream. This is ok to merge from my perspective.

If you want this on the 8.12 branch of this repo, then just make a backport PR to 8.12 after merge (manual process)

[elasticmachine]

Package endpoint - 8.13.0 containing this change is available at https://epr.elastic.co/search?package=endpoint