[SIEM] Add apm-*-transcation* to siemDefaultIndex Kibana Advanced Setting

[spong]

In effort to augment the SIEM UI with APM data we'll need to include apm-* in the siem:defaultIndex Kibana Advanced Setting.

10-DEC-2019: Editing title to be apm-*-transcation* instead of apm-*

[elasticmachine]

Pinging @elastic/siem (Team:SIEM)

[spong]

cc @elastic/apm

[sorenlouv]

fyi: Users can configure which index apm is written to. There are config options in kibana.dev.yml for this:

apm_oss.errorIndices: apm-*-error*
apm_oss.transactionIndices: apm-*-transaction*
apm_oss.spanIndices: apm-*-span*
apm_oss.metricsIndices: apm-*-metric*

We've recently introduced the possibility of overwriting these settings via the UI and thus stored in saved objects - which could make this a little more complicated for you. LMK if you need further details.

[spong]

Thanks for the details @sqren -- the question of additional apm indices came up when we were discussing this, so I'll touch base with the team and detail feedback here before moving forward.

[tsg]

The question is if we add apm-* or just apm-*-transaction* as the default in SIEM. I'm leaning towards apm-*-transcation*, since I think that contains all the data that we might need for 7.6. In future versions we might query the spans as well, for example, but we can always add it later and start a bit more conservative.

[spong]

Sounds good! Will move forward with adding apm-*-transcation* to siem:defaultIndex.

In effort to ensure the SIEM Map displays APM data without any additional configuration (since it requires a matching named Kibana Index Pattern), I'm going to make a slight enhancement to how the map layers are generated. When the map is checking for matching Kibana Index Patterns, it'll match apm-*-transcation* -> apm-* (if exists), and then create a corresponding map layer for client/server geo fields (instead of the usual source/dest) since these are the fields Transactions use.

The maps config generation is fairly well abstracted, so this'll be a pretty simple change and something we can expand upon further if/when we decide to add any other indices.