[FireEye] Add missing ECS fields

[moxarth-rathod]

Proposed commit message

fireeye: add missing ECS fields

This PR has added the missing ECS fields like event, file, IP related fields, etc.

Checklist

• I have reviewed tips for building integrations and this pull request is aligned with them.
• I have verified that all data streams collect metrics or logs.
• I have added an entry to my package's changelog.yml file.
• I have verified that Kibana version constraints are current according to guidelines.
• I have verified that any added dashboard complies with Kibana's Dashboard good practices

How to test this PR locally

• Clone integrations repo.
• Install elastic package locally.
• Start elastic stack using elastic-package.
• Move to integrations/packages/fireeye directory.
• Run the following command to run tests.

elastic-package test -v

Related issues

• Closes [FireEye Network Security]: ECS Fields Missing #13756

[elasticmachine]

Pinging @elastic/security-service-integrations (Team:Security-Service Integrations)

[elastic-vault-github-plugin-prod]

🚀 Benchmarks report

To see the full report comment with /test benchmark fullreport

[andrewkroh]

I think this can be written out as "if foo equals failed || if foo equals succeeded" to avoid allocating a new list in each expression eval.

[kcreddy]

For issue suggestion: tls.client.server_name > destination.hostname, the correct mapping should be into destination.domain

[moxarth-rathod]

For issue suggestion: tls.client.server_name > destination.hostname, the correct mapping should be into destination.domain

Yes, i've mapped tls.client.server_name to destination.domain here -

integrations/packages/fireeye/data_stream/nx/elasticsearch/ingest_pipeline/renaming-raws.yml

Lines 485 to 489 in 595c3c9

	- set:
	field: destination.domain
	tag: set_destination_domain_from_server_name
	copy_from: tls.client.server_name
	ignore_empty_value: true

[elasticmachine]

💚 Build Succeeded

• Buildkite Build
• Commit: 595c3c9

History

• 💚 Build #28959 succeeded 9284d00
• 💚 Build #28802 succeeded c7ac94d
• 💚 Build #28637 succeeded 7a55036
• 💚 Build #28625 succeeded 2a3efcf
• 💚 Build #28585 succeeded 96289c6

cc @moxarth-rathod

[elastic-sonarqube]

Quality Gate passed

Issues
0 New issues
0 Fixed issues
0 Accepted issues

Measures
0 Security Hotspots
93.8% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube