Elastic-Agent CEF Integration Mapping missing event.* fields

[iamhowardtheduck]

The CEF integration for Elastic-Agent is missing several event.(kind, id, start, & end) fields. Without this mapping, conflicts occur within the logs-* data view

[elasticmachine]

Pinging @elastic/integrations (Team:Integrations)

[elasticmachine]

Pinging @elastic/security-external-integrations (Team:Security-External Integrations)

[andrewkroh]

I was trying to figure out how we missed this sort of issue in so many integrations. I tracked it to this line https://github.com/elastic/elastic-package/blob/a4a0b19d768eee14582acfb58a816823110a8980/internal/fields/validate.go#L266 which skips checks on event.*. Removing that check here yields:

Run pipeline tests for the package
--- Test results for package: cef - START ---
FAILURE DETAILS:
cef/log test-cef.json:
[0] field "event.code" is undefined
[1] field "event.id" is undefined
[2] field "event.severity" is undefined
cef/log test-checkpoint.json:
[0] field "event.action" is undefined
[1] field "event.category" is undefined
[2] field "event.code" is undefined
[3] field "event.duration" is undefined
[4] field "event.kind" is undefined
[5] field "event.risk_score" is undefined
[6] field "event.severity" is undefined
cef/log test-fp-ngfw-smc.json:
[0] field "event.action" is undefined
[1] field "event.code" is undefined
[2] field "event.severity" is undefined

[andrewkroh]

Relates: elastic/elastic-package#147

[andrewkroh]

Also found

--- Test results for package: cef - START ---
FAILURE DETAILS:
cef/log test-cef.json:
[0] parsing field value failed: field "event.id"'s Go type, float64, does not match the expected field type: keyword (field value: 123)
[1] parsing field value failed: field "event.id"'s Go type, float64, does not match the expected field type: keyword (field value: 3457)
cef/log test-checkpoint.json:
[0] parsing field value failed: field "event.risk_score"'s Go type, string, does not match the expected field type: float (field value: 4)
[1] parsing field value failed: field "event.severity"'s Go type, string, does not match the expected field type: long (field value: 4)

[andrewkroh]

PR to fix: #2808