[jamf_protect] Update default.yml pipeline

[txhaflaire]

• Bug

Proposed commit message

• Reverted back a change that was proposed, fields were not mapped correctly.

Checklist

• I have reviewed tips for building integrations and this pull request is aligned with them.
• I have verified that all data streams collect metrics or logs.
• I have added an entry to my package's changelog.yml file.
• I have verified that Kibana version constraints are current according to guidelines.

How to test this PR locally

--- Test results for package: jamf_protect - START ---
╭──────────────┬────────────────────┬───────────┬───────────────────────────────────────────────────────────────────────┬────────┬──────────────╮
│ PACKAGE      │ DATA STREAM        │ TEST TYPE │ TEST NAME                                                             │ RESULT │ TIME ELAPSED │
├──────────────┼────────────────────┼───────────┼───────────────────────────────────────────────────────────────────────┼────────┼──────────────┤
│ jamf_protect │                    │ asset     │ dashboard jamf_protect-e9b86210-c65c-11ee-882f-57f79af43d7f is loaded │ PASS   │     60.833µs │
│ jamf_protect │ alerts             │ asset     │ index_template logs-jamf_protect.alerts is loaded                     │ PASS   │        542ns │
│ jamf_protect │ alerts             │ asset     │ ingest_pipeline logs-jamf_protect.alerts-0.2.0 is loaded              │ PASS   │        292ns │
│ jamf_protect │ telemetry          │ asset     │ index_template logs-jamf_protect.telemetry is loaded                  │ PASS   │        417ns │
│ jamf_protect │ telemetry          │ asset     │ ingest_pipeline logs-jamf_protect.telemetry-0.2.0 is loaded           │ PASS   │        250ns │
│ jamf_protect │ web_threat_events  │ asset     │ index_template logs-jamf_protect.web_threat_events is loaded          │ PASS   │        458ns │
│ jamf_protect │ web_threat_events  │ asset     │ ingest_pipeline logs-jamf_protect.web_threat_events-0.2.0 is loaded   │ PASS   │        750ns │
│ jamf_protect │ web_traffic_events │ asset     │ index_template logs-jamf_protect.web_traffic_events is loaded         │ PASS   │        375ns │
│ jamf_protect │ web_traffic_events │ asset     │ ingest_pipeline logs-jamf_protect.web_traffic_events-0.2.0 is loaded  │ PASS   │        500ns │
╰──────────────┴────────────────────┴───────────┴───────────────────────────────────────────────────────────────────────┴────────┴──────────────╯
--- Test results for package: jamf_protect - END   ---
Done
Run pipeline tests for the package
2024/04/12 16:25:00 DEBUG Package does not embed ECS mappings
2024/04/12 16:25:02 DEBUG Package does not embed ECS mappings
2024/04/12 16:25:04 DEBUG Package does not embed ECS mappings
2024/04/12 16:25:04 DEBUG Package does not embed ECS mappings
--- Test results for package: jamf_protect - START ---
╭──────────────┬────────────────────┬───────────┬─────────────────────────────────────────────┬────────┬──────────────╮
│ PACKAGE      │ DATA STREAM        │ TEST TYPE │ TEST NAME                                   │ RESULT │ TIME ELAPSED │
├──────────────┼────────────────────┼───────────┼─────────────────────────────────────────────┼────────┼──────────────┤
│ jamf_protect │ alerts             │ pipeline  │ test-jamf-protect-alerts-sample-logs.log    │ PASS   │  50.961292ms │
│ jamf_protect │ telemetry          │ pipeline  │ test-jamf-protect-telemetry-sample-logs.log │ PASS   │  11.862208ms │
│ jamf_protect │ web_threat_events  │ pipeline  │ test-jamf-protect-threat-sample-logs.log    │ PASS   │     15.507ms │
│ jamf_protect │ web_traffic_events │ pipeline  │ test-jamf-protect-traffic-sample-logs.log   │ PASS   │   5.883125ms │
╰──────────────┴────────────────────┴───────────┴─────────────────────────────────────────────┴────────┴──────────────╯
--- Test results for package: jamf_protect - END   ---
Done
Run static tests for the package
2024/04/12 16:25:04 DEBUG Package does not embed ECS mappings
2024/04/12 16:25:04 DEBUG Package does not embed ECS mappings
2024/04/12 16:25:04 DEBUG Package does not embed ECS mappings
2024/04/12 16:25:04 DEBUG Package does not embed ECS mappings
--- Test results for package: jamf_protect - START ---
╭──────────────┬────────────────────┬───────────┬──────────────────────────┬────────┬──────────────╮
│ PACKAGE      │ DATA STREAM        │ TEST TYPE │ TEST NAME                │ RESULT │ TIME ELAPSED │
├──────────────┼────────────────────┼───────────┼──────────────────────────┼────────┼──────────────┤
│ jamf_protect │ alerts             │ static    │ Verify sample_event.json │ PASS   │ 115.627417ms │
│ jamf_protect │ telemetry          │ static    │ Verify sample_event.json │ PASS   │ 135.883667ms │
│ jamf_protect │ web_threat_events  │ static    │ Verify sample_event.json │ PASS   │  75.926292ms │
│ jamf_protect │ web_traffic_events │ static    │ Verify sample_event.json │ PASS   │  70.594625ms │
╰──────────────┴────────────────────┴───────────┴──────────────────────────┴────────┴──────────────╯
--- Test results for package: jamf_protect - END   ---
Done
Run system tests for the package
2024/04/12 16:25:04 DEBUG GET https://127.0.0.1:5601/api/status
--- Test results for package: jamf_protect - START ---
No test results
--- Test results for package: jamf_protect - END   ---
Done

[kcreddy]

/test

[elasticmachine]

🚀 Benchmarks report

To see the full report comment with /test benchmark fullreport

[elasticmachine]

💚 Build Succeeded

• Buildkite Build
• Commit: b5ec08c

[elastic-sonarqube]

Quality Gate passed

Kudos, no new issues were introduced!

0 New issues
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube

[elasticmachine]

Pinging @elastic/security-service-integrations (Team:Security-Service Integrations)

[efd6]

It would be nice to have some system tests that would have caught this.

[kcreddy]

LGTM 👍🏼
I agree with @efd6 on adding system tests.

[elasticmachine]

Package jamf_protect - 0.3.0 containing this change is available at https://epr.elastic.co/search?package=jamf_protect