infoblox_bloxone_ddi: map dns fields to ecs

[efd6]

Proposed commit message

See title.

Checklist

• I have reviewed tips for building integrations and this pull request is aligned with them.
• I have verified that all data streams collect metrics or logs.
• I have added an entry to my package's changelog.yml file.
• I have verified that Kibana version constraints are current according to guidelines.

Author's Checklist

• [ ]

How to test this PR locally

Related issues

• Closes [Infoblox BloxOne DDI] DNS Data Records Not Populating ECS Fields #9039

Screenshots

[elasticmachine]

🚀 Benchmarks report

Package infoblox_bloxone_ddi 👍(2) 💚(0) 💔(1)

Expand to view

Data stream	Previous EPS	New EPS	Diff (%)	Result
dns_config	1394.7	1098.9	-295.8 (-21.21%)	💔

To see the full report comment with /test benchmark fullreport

[elasticmachine]

💚 Build Succeeded

• Buildkite Build
• Commit: c39fe7d

History

• 💔 Build #8622 failed 0e8dd81

cc @efd6

[elastic-sonarqube]

Quality Gate passed

Kudos, no new issues were introduced!

0 New issues
0 Security Hotspots
86.5% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube

[elasticmachine]

Pinging @elastic/security-service-integrations (Team:Security-Service Integrations)

[chrisberkhout]

Good.

[chrisberkhout]

I was concerned that there would be a problem with having a non-leaf-node array, since that had come up for me earlier. I thought it might not show in the pipeline tests, so I added a case to the system test, and also modified the pipeline to add the answers object twice. But there were no problems indexing that.

I think it didn't work for me in the past because, for example, when using threat.indicator.url.*, I was getting definitions for the fields by explicitly importing subfields like threat.indicator.url.full without ever having threat.indicator.url explicitly defined as a group, or I was relying on dynamic mappings to get threat.indicator.url.full which also don't define the parent group.

[efd6]

I think it didn't work for me in the past because, for example, when using threat.indicator.url.*, I was getting definitions for the fields by explicitly importing subfields like threat.indicator.url.full without ever having threat.indicator.url explicitly defined as a group, or I was relying on dynamic mappings to get threat.indicator.url.full which also don't define the parent group.

Yes, this was the behaviour I was seeing. It is a little confusing.

[elasticmachine]

Package infoblox_bloxone_ddi - 1.15.0 containing this change is available at https://epr.elastic.co/search?package=infoblox_bloxone_ddi