all: fix sample events to agree with ECS

[efd6]

Proposed commit message

* cisco_umbrella
* forgerock
* lumos
* mattermost
* microsoft_exchange_online_message_trace
* pulse_connect_secure
* sentinel_one
* ti_cybersixgill
* trend_micro_vision_one

Also fix missed changelog entry link in crowdstrike package.

The first commit was generated with

for p in cisco_umbrella forgerock lumos mattermost microsoft_exchange_online_message_trace pulse_connect_secure sentinel_one ti_cybersixgill trend_micro_vision_one;
do (
  cd $p;
  elastic-package test system -g && \
  elastic-package build && \
  elastic-package changelog add \
    --type bugfix \
    --next patch \
    --description 'Fix sample event.' \
    --link https://github.com/elastic/integrations/pull/10136
); done

Checklist

• I have reviewed tips for building integrations and this pull request is aligned with them.
• I have verified that all data streams collect metrics or logs.
• I have added an entry to my package's changelog.yml file.
• I have verified that Kibana version constraints are current according to guidelines.

Author's Checklist

• [ ]

How to test this PR locally

Related issues

• For all: migrate ssi packages to ecs@mappings #10135

Screenshots

[elasticmachine]

🚀 Benchmarks report

To see the full report comment with /test benchmark fullreport

[elastic-sonarqube]

Quality Gate passed

Issues
0 New issues
0 Fixed issues
0 Accepted issues

Measures
0 Security Hotspots
No data about Coverage
No data about Duplication

See analysis details on SonarQube

[elasticmachine]

💚 Build Succeeded

• Buildkite Build
• Commit: 090c078

cc @efd6

[elasticmachine]

Pinging @elastic/security-service-integrations (Team:Security-Service Integrations)

[kcreddy]

Should we be using -next instead of bumping patch, as the change is related to running just the tests?

[kcreddy]

Is this change related to new elastic-package version?

[efd6]

Yes. I run ep at tip and this was changed in elastic/elastic-package@3cc9d99.

[elasticmachine]

Package cisco_umbrella - 1.24.1 containing this change is available at https://epr.elastic.co/search?package=cisco_umbrella

[elasticmachine]

Package forgerock - 1.17.1 containing this change is available at https://epr.elastic.co/search?package=forgerock

[elasticmachine]

Package lumos - 1.2.1 containing this change is available at https://epr.elastic.co/search?package=lumos

[elasticmachine]

Package mattermost - 2.0.1 containing this change is available at https://epr.elastic.co/search?package=mattermost

[elasticmachine]

Package microsoft_exchange_online_message_trace - 1.21.1 containing this change is available at https://epr.elastic.co/search?package=microsoft_exchange_online_message_trace

[elasticmachine]

Package pulse_connect_secure - 2.0.1 containing this change is available at https://epr.elastic.co/search?package=pulse_connect_secure

[elasticmachine]

Package sentinel_one - 1.23.1 containing this change is available at https://epr.elastic.co/search?package=sentinel_one

[elasticmachine]

Package ti_cybersixgill - 1.29.1 containing this change is available at https://epr.elastic.co/search?package=ti_cybersixgill

[elasticmachine]

Package trend_micro_vision_one - 1.19.1 containing this change is available at https://epr.elastic.co/search?package=trend_micro_vision_one