auditd: handle ENRICHED auditd format

[efd6]

Proposed commit message

Spec for format: https://github.com/linux-audit/audit-documentation/wiki/SPEC-Audit-Event-Enrichment

Checklist

• I have reviewed tips for building integrations and this pull request is aligned with them.
• I have verified that all data streams collect metrics or logs.
• I have added an entry to my package's changelog.yml file.
• I have verified that Kibana version constraints are current according to guidelines.

Author's Checklist

• [ ]

How to test this PR locally

Related issues

• Closes [Auditd Logs] Support ENRICHED log format #5343

Screenshots

[efd6]

GitHub does a poor job at rendering the diff here; git shows this:

diff --git a/packages/auditd/data_stream/log/_dev/test/pipeline/test-auditd-enriched.log b/packages/auditd/data_stream/log/_dev/test/pipeline/test-auditd-enriched.log
new file mode 100644
index 000000000..760f90b35
--- /dev/null
+++ b/packages/auditd/data_stream/log/_dev/test/pipeline/test-auditd-enriched.log
@@ -0,0 +1,3 @@
+type=SOCKADDR msg=audit(1666825569.818:23260118): saddr=02000000000000000000000000000000^]SADDR={ saddr_fam=inet laddr=0.0.0.0 lport=0 }
+type=SOCKADDR msg=audit(1666825569.435:23260106): saddr=0A00DE9900000000000000000000000000002a02cf40000000000000^]SADDR={ saddr_fam=inet6 laddr=2a02:cf40:: lport=56985 }
+type=SOCKADDR msg=audit(1666825568.865:23260105): saddr=0100^]SADDR={ saddr_fam=local sockaddr len too short }

[elasticmachine]

💚 Build Succeeded

the below badges are clickable and redirect to their specific view in the CI or DOCS

Expand to view the summary

Build stats

• Start Time: 2023-12-14T20:31:32.376+0000

• Duration: 14 min 27 sec

Test stats 🧪

Test	Results
Failed	0
Passed	10
Skipped	0
Total	10

🤖 GitHub comments

Expand to view the GitHub comments

To re-run your PR in the CI, just comment with:

• /test : Re-trigger the build.

[elasticmachine]

🌐 Coverage report

Name	Metrics % (covered/total)	Diff
Packages	100.0% (1/1)	💚
Files	100.0% (1/1)	💚 3.929
Classes	100.0% (1/1)	💚 3.929
Methods	100.0% (15/15)	💚 7.585
Lines	98.051% (2214/2258)	👍 9.41
Conditionals	100.0% (0/0)	💚

[elasticmachine]

🚀 Benchmarks report

To see the full report comment with /test benchmark fullreport

[elasticmachine]

Pinging @elastic/security-external-integrations (Team:Security-External Integrations)

[kgeller]

extra r after format?

Suggested change

	- description: Handle ENRICHED audit formatr.
	- description: Handle ENRICHED audit format.

[efd6]

Thanks

[kgeller]

tiny question on the changelog description, otherwise LGTM

[elasticmachine]

Package auditd - 3.18.0 containing this change is available at https://epr.elastic.co/search?package=auditd