[aws, blacklens, github, microsoft_sentinel] Resolve conflicting event.kind values in constant_keyword fields

[mohitjha-elastic]

Proposed commit message

aws, blacklens, github, microsoft_sentinel: fix conflicting event.kind values.

Fix conflicting event.kind mappings where pipelines set pipeline_error (or state) while the field 
was defined as constant_keyword, which Elasticsearch treats as a single immutable value per index. 
The securityhub_findings_full_posture data stream now references ECS for event.kind, matching the
sibling Security Hub stream. 
For blacklens alerts, GitHub issues/code_scanning/dependabot/secret_scanning, 
and Microsoft Sentinel alert/event/incident streams, event.kind is mapped as keyword and the 
ingest pipelines set the normal ECS value (alert or event) so successful documents stay unchanged
while failure handlers can still set pipeline_error. 

Checklist

• I have reviewed tips for building integrations and this pull request is aligned with them.
• I have verified that all data streams collect metrics or logs.
• I have added an entry to my package's changelog.yml file.
• I have verified that Kibana version constraints are current according to guidelines.
• I have verified that any added dashboard complies with Kibana's Dashboard good practices

How to test this PR locally

• Clone integrations repo.
• Install the elastic package locally.
• Start the elastic stack using the elastic package.
• Move to integrations/packages/<integration_name> directory.
• Run the following command to run tests.

Replace the <integration_name> with the actual name of integration.

elastic-package test -v

Related issues

• Closes [aws, blacklens, github, microsoft_sentinel] Conflicting event.kind values in constant_keyword fields #17561

[elasticmachine]

Pinging @elastic/security-service-integrations (Team:Security-Service Integrations)

[github-actions]

Vale Linting Results

Summary: 15 warnings, 27 suggestions found

⚠️ Warnings (15)

File	Line	Rule	Message
packages/aws/docs/securityhub.md	1384	Elastic.QuotesPunctuation	Place punctuation inside closing quotation marks.
packages/aws/docs/securityhub.md	1385	Elastic.Latinisms	Latin terms and abbreviations are a common source of confusion. Use 'for example' instead of 'e.g'.
packages/aws/docs/securityhub.md	1387	Elastic.Latinisms	Latin terms and abbreviations are a common source of confusion. Use 'for example' instead of 'e.g'.
packages/github/docs/README.md	233	Elastic.QuotesPunctuation	Place punctuation inside closing quotation marks.
packages/github/docs/README.md	234	Elastic.Latinisms	Latin terms and abbreviations are a common source of confusion. Use 'for example' instead of 'e.g'.
packages/github/docs/README.md	236	Elastic.Latinisms	Latin terms and abbreviations are a common source of confusion. Use 'for example' instead of 'e.g'.
packages/github/docs/README.md	412	Elastic.QuotesPunctuation	Place punctuation inside closing quotation marks.
packages/github/docs/README.md	413	Elastic.Latinisms	Latin terms and abbreviations are a common source of confusion. Use 'for example' instead of 'e.g'.
packages/github/docs/README.md	415	Elastic.Latinisms	Latin terms and abbreviations are a common source of confusion. Use 'for example' instead of 'e.g'.
packages/github/docs/README.md	568	Elastic.QuotesPunctuation	Place punctuation inside closing quotation marks.
packages/github/docs/README.md	569	Elastic.Latinisms	Latin terms and abbreviations are a common source of confusion. Use 'for example' instead of 'e.g'.
packages/github/docs/README.md	571	Elastic.Latinisms	Latin terms and abbreviations are a common source of confusion. Use 'for example' instead of 'e.g'.
packages/github/docs/README.md	801	Elastic.QuotesPunctuation	Place punctuation inside closing quotation marks.
packages/github/docs/README.md	802	Elastic.Latinisms	Latin terms and abbreviations are a common source of confusion. Use 'for example' instead of 'e.g'.
packages/github/docs/README.md	804	Elastic.Latinisms	Latin terms and abbreviations are a common source of confusion. Use 'for example' instead of 'e.g'.

💡 Suggestions (27)

File	Line	Rule	Message
packages/aws/docs/securityhub.md	1386	Elastic.Wordiness	Consider using 'tell' instead of 'inform'.
packages/aws/docs/securityhub.md	1386	Elastic.WordChoice	Consider using 'can, might' instead of 'may', unless the term is in the UI.
packages/aws/docs/securityhub.md	1386	Elastic.WordChoice	Consider using 'can, might' instead of 'may', unless the term is in the UI.
packages/blacklens/docs/README.md	148	Elastic.Wordiness	Consider using 'tell' instead of 'inform'.
packages/blacklens/docs/README.md	148	Elastic.WordChoice	Consider using 'can, might' instead of 'may', unless the term is in the UI.
packages/blacklens/docs/README.md	148	Elastic.WordChoice	Consider using 'can, might' instead of 'may', unless the term is in the UI.
packages/github/docs/README.md	235	Elastic.Wordiness	Consider using 'tell' instead of 'inform'.
packages/github/docs/README.md	235	Elastic.WordChoice	Consider using 'can, might' instead of 'may', unless the term is in the UI.
packages/github/docs/README.md	235	Elastic.WordChoice	Consider using 'can, might' instead of 'may', unless the term is in the UI.
packages/github/docs/README.md	414	Elastic.Wordiness	Consider using 'tell' instead of 'inform'.
packages/github/docs/README.md	414	Elastic.WordChoice	Consider using 'can, might' instead of 'may', unless the term is in the UI.
packages/github/docs/README.md	414	Elastic.WordChoice	Consider using 'can, might' instead of 'may', unless the term is in the UI.
packages/github/docs/README.md	570	Elastic.Wordiness	Consider using 'tell' instead of 'inform'.
packages/github/docs/README.md	570	Elastic.WordChoice	Consider using 'can, might' instead of 'may', unless the term is in the UI.
packages/github/docs/README.md	570	Elastic.WordChoice	Consider using 'can, might' instead of 'may', unless the term is in the UI.
packages/github/docs/README.md	803	Elastic.Wordiness	Consider using 'tell' instead of 'inform'.
packages/github/docs/README.md	803	Elastic.WordChoice	Consider using 'can, might' instead of 'may', unless the term is in the UI.
packages/github/docs/README.md	803	Elastic.WordChoice	Consider using 'can, might' instead of 'may', unless the term is in the UI.
packages/microsoft_sentinel/docs/README.md	191	Elastic.Wordiness	Consider using 'tell' instead of 'inform'.
packages/microsoft_sentinel/docs/README.md	191	Elastic.WordChoice	Consider using 'can, might' instead of 'may', unless the term is in the UI.
packages/microsoft_sentinel/docs/README.md	191	Elastic.WordChoice	Consider using 'can, might' instead of 'may', unless the term is in the UI.
packages/microsoft_sentinel/docs/README.md	253	Elastic.Wordiness	Consider using 'tell' instead of 'inform'.
packages/microsoft_sentinel/docs/README.md	253	Elastic.WordChoice	Consider using 'can, might' instead of 'may', unless the term is in the UI.
packages/microsoft_sentinel/docs/README.md	253	Elastic.WordChoice	Consider using 'can, might' instead of 'may', unless the term is in the UI.
packages/microsoft_sentinel/docs/README.md	434	Elastic.Wordiness	Consider using 'tell' instead of 'inform'.
packages/microsoft_sentinel/docs/README.md	434	Elastic.WordChoice	Consider using 'can, might' instead of 'may', unless the term is in the UI.
packages/microsoft_sentinel/docs/README.md	434	Elastic.WordChoice	Consider using 'can, might' instead of 'may', unless the term is in the UI.

---

The Vale linter checks documentation changes against the Elastic Docs style guide.

To use Vale locally or report issues, refer to Elastic style guide for Vale.

[andrewkroh]

event.kind is an ECS field and should be defined using external: ecs rather than type: keyword.

https://github.com/elastic/integrations/wiki/Fleet-Package-Code-Review-Comments#defining-an-ecs-field-without-using-an-external-definition

---

fwiw You can detect and fix (add -fix) this class of issue automatically using

go run github.com/andrewkroh/fydler@main -a useecs packages/blacklens/data_stream/alerts/fields/ecs.yml

[mohitjha-elastic]

Updated all occurrences of event.kind to be defined using external: ecs.

[elastic-vault-github-plugin-prod]

🚀 Benchmarks report

To see the full report comment with /test benchmark fullreport

[elasticmachine]

💚 Build Succeeded

• Buildkite Build
• Commit: c465386

History

• 💚 Build #40625 succeeded edc2779
• 💔 Build #40610 failed 3dbc1ff

cc @mohitjha-elastic

[muthu-mps]

code owner approval.

[elastic-vault-github-plugin-prod]

Package aws - 6.4.3 containing this change is available at https://epr.elastic.co/package/aws/6.4.3/

[elastic-vault-github-plugin-prod]

Package blacklens - 1.0.1 containing this change is available at https://epr.elastic.co/package/blacklens/1.0.1/

[elastic-vault-github-plugin-prod]

Package github - 2.22.1 containing this change is available at https://epr.elastic.co/package/github/2.22.1/

[elastic-vault-github-plugin-prod]

Package microsoft_sentinel - 1.3.1 containing this change is available at https://epr.elastic.co/package/microsoft_sentinel/1.3.1/