[Zscaler Private Access] Issue mapping event.created in audit logs

[srilumpa]

Hello,

I have noticed a mapping issue for the event.created field set here and introduced in 71c5255. This change made the event.created field mapped to a keyword type instead of a date, either because the set processor copies it as a string or because the mapping of this specific field is not set for the data stream.

If needed, I can prepare a PR to try to fix this issue.

[elasticmachine]

Pinging @elastic/security-external-integrations (Team:Security-External Integrations)

[vinit-chauhan]

Hey @srilumpa - Thanks for bringing it to our attention.
As you mentioned, it seems like there is some issue with the ECS mappings, and I really appreciate your willingness to raise a PR. However, we are already working on an enhancement in the package, where we are planning to leverage the newly introduced dynamic ECS, which would resolve this issue.
I will keep you posted on any updates. 😄

[elasticmachine]

Package zscaler_zpa - 1.5.1 containing this change is available at https://epr.elastic.co/search?package=zscaler_zpa