[Recorded Future] Fix mapping for primary_entity

[moxarth-rathod]

Proposed commit message

ti_recordedfuture: Fix mapping for primary_entity and use_case_deprecation

primary_entity is an object and was wrongly mapped as  keyword. 
To fix this, add primary_entity.id, primary_entity.name, and primary_entity.type
in fields.yml. No pipeline changes are needed, as all fields are keyword and 
the json is mapped directly to recordedfuture.triggered_alert.

Checklist

• I have reviewed tips for building integrations and this pull request is aligned with them.
• I have verified that all data streams collect metrics or logs.
• I have added an entry to my package's changelog.yml file.
• I have verified that Kibana version constraints are current according to guidelines.
• I have verified that any added dashboard complies with Kibana's Dashboard good practices

Related issues

• Closes ti_recordedfuture: triggered_alert field is incorrectly mapped as keyword #18136

[cla-checker-service]

💚 CLA has been signed

[elasticmachine]

Pinging @elastic/security-service-integrations (Team:Security-Service Integrations)

[github-actions]

✅ Vale Linting Results

No issues found on modified lines!

---

The Vale linter checks documentation changes against the Elastic Docs style guide.

To use Vale locally or report issues, refer to Elastic style guide for Vale.

[elastic-vault-github-plugin-prod]

🚀 Benchmarks report

To see the full report comment with /test benchmark fullreport

[kcreddy]

From the issue follow-up comments:

recordedfuture.triggered_alert itself is currently mapped as a group (object), but one nested field appears mismatched: recordedfuture.triggered_alert.rule.use_case_deprecation is mapped as keyword while test/sample payloads provide an object ({"description": null}), which can trigger mapping conflicts.
Recommendation
Update recordedfuture.triggered_alert.rule.use_case_deprecation from keyword to group and define its child field(s), then regenerate package docs/assets and run package validation tests.

Can you fix this as well?

[kcreddy]

LGTM, after updating the commit message as well (include use_case_deprecation).

[elasticmachine]

💚 Build Succeeded

• Buildkite Build
• Commit: d761ffc

History

• 💚 Build #41211 succeeded 6c92871

cc @moxarth-rathod

[elastic-vault-github-plugin-prod]

Package ti_recordedfuture - 2.4.2 containing this change is available at https://epr.elastic.co/package/ti_recordedfuture/2.4.2/