hid_bravura_monitor,imperva,infoblox_*,zscalar_*: remove duplicate fields

[efd6]

What does this PR do?

This removes duplicate field definitions in hid_bravura_monitor, imperva, infoblox_bloxoneddi, infoblox_nios ,zscalar_zia and zscalar_zpa.

It also makes minor bugfixes in two packages.

• markdown syntax for proxy_url description in infoblox_bloxone_ddi
• normalization of x509.issuer.common_name in zpa

Checklist

• I have reviewed tips for building integrations and this pull request is aligned with them.
• I have verified that all data streams collect metrics or logs.
• I have added an entry to my package's changelog.yml file.
• I have verified that Kibana version constraints are current according to guidelines.

Author's Checklist

• [ ]

How to test this PR locally

Related issues

• For sei: multiple packages with duplicated field definitions #4398

Screenshots

[elasticmachine]

💚 Build Succeeded

the below badges are clickable and redirect to their specific view in the CI or DOCS

Expand to view the summary

Build stats

• Start Time: 2022-11-29T06:33:06.877+0000

• Duration: 22 min 7 sec

Test stats 🧪

Test	Results
Failed	0
Passed	261
Skipped	0
Total	261

🤖 GitHub comments

Expand to view the GitHub comments

To re-run your PR in the CI, just comment with:

• /test : Re-trigger the build.

[elasticmachine]

🚀 Benchmarks report

To see the full report comment with /test benchmark fullreport

[elasticmachine]

🌐 Coverage report

Name	Metrics % (covered/total)	Diff
Packages	100.0% (17/17)	💚
Files	100.0% (20/20)	💚 3.828
Classes	100.0% (20/20)	💚 3.828
Methods	98.319% (234/238)	👍 11.998
Lines	94.429% (6729/7126)	👍 0.341
Conditionals	100.0% (0/0)	💚

[elasticmachine]

Pinging @elastic/security-external-integrations (Team:Security-External Integrations)

[kcreddy]

LGTM 👍🏼 Just minor clarifications and resolving conflicts.

1. zscaler_zia.firewall: Couldn't find host.hostname field in ecs.yml

2. Also, just looking for conformity/preference:

   In imperva these are the duplicates:
   "securesphere": @timestamp base-fields.yml, ecs.yml
   "securesphere": tags base-fields.yml, ecs.yml

   PR removes @timestamp from base-fields.yml but tags from ecs.yml. Is there any preference of one over the other?

[efd6]

1. Yep, it looks like this was removed in 864f94c#diff-1e300be11bf240a33db1347d839996c0a73a33202d0525a8a7b6d67038ee561b. Given this, I don't know how safe this change is. I'll rebase onto main and recheck after fixing the conflicts.
2. I don't have a real preference. I would love it if there were only one file. I guess my preference is the option that has the lowest amount of text remaining, but what I have done over the full set is not necessarily consistent.

[elasticmachine]

Package hid_bravura_monitor - 1.3.1 containing this change is available at https://epr.elastic.co/search?package=hid_bravura_monitor

[elasticmachine]

Package imperva - 0.11.1 containing this change is available at https://epr.elastic.co/search?package=imperva

[elasticmachine]

Package infoblox_bloxone_ddi - 0.2.2 containing this change is available at https://epr.elastic.co/search?package=infoblox_bloxone_ddi

[elasticmachine]

Package infoblox_bloxone_ddi - 0.2.2 containing this change is available at https://epr.elastic.co/search?package=infoblox_bloxone_ddi

[elasticmachine]

Package infoblox_nios - 1.4.2 containing this change is available at https://epr.elastic.co/search?package=infoblox_nios

[elasticmachine]

Package zscaler_zia - 2.6.1 containing this change is available at https://epr.elastic.co/search?package=zscaler_zia

[elasticmachine]

Package zscaler_zpa - 1.4.1 containing this change is available at https://epr.elastic.co/search?package=zscaler_zpa

[elasticmachine]

Package zscaler_zpa - 1.4.1 containing this change is available at https://epr.elastic.co/search?package=zscaler_zpa

[kcreddy]

1. Yep, it looks like this was removed in 864f94c#diff-1e300be11bf240a33db1347d839996c0a73a33202d0525a8a7b6d67038ee561b. Given this, I don't know how safe this change is. I'll rebase onto main and recheck after fixing the conflicts.
2. I don't have a real preference. I would love it if there were only one file. I guess my preference is the option that has the lowest amount of text remaining, but what I have done over the full set is not necessarily consistent.

Great, thanks!!