[tanium] Map extra fields, set event.kind for alerts

[chrisberkhout]

Proposed commit message

[tanium] Map extra fields, set event.kind for alerts

- Map extra fields from the new default `threat_response` format.
- Set `event.kind` as a scalar not an array.
- Set `event.kind` to `alert` if an alert ID is present.

Checklist

• I have reviewed tips for building integrations and this pull request is aligned with them.
• I have verified that all data streams collect metrics or logs.
• I have added an entry to my package's changelog.yml file.
• I have verified that Kibana version constraints are current according to guidelines.
• I have verified that any added dashboard complies with Kibana's Dashboard good practices

[elasticmachine]

Pinging @elastic/security-service-integrations (Team:Security-Service Integrations)

[elastic-vault-github-plugin-prod]

🚀 Benchmarks report

Package tanium 👍(3) 💚(2) 💔(1)

Expand to view

Data stream	Previous EPS	New EPS	Diff (%)	Result
client_status	10638.3	5405.41	-5232.89 (-49.19%)	💔

To see the full report comment with /test benchmark fullreport

[efd6]

This allocates.

[chrisberkhout]

changed to

if: ctx.tanium?.threat_response?.alert_id != null && ctx.tanium.threat_response.alert_id != ''

[elasticmachine]

💚 Build Succeeded

• Buildkite Build
• Commit: 79a1ae5

History

• 💚 Build #19345 succeeded af1a09f
• 💚 Build #19289 succeeded 49a3dc4

cc @chrisberkhout

[elastic-sonarqube]

Quality Gate passed

Issues
0 New issues
0 Fixed issues
0 Accepted issues

Measures
0 Security Hotspots
100.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube

[elastic-vault-github-plugin-prod]

Package tanium - 1.12.0 containing this change is available at https://epr.elastic.co/package/tanium/1.12.0/