[checkpoint_email] Populate additional ECS fields for the event types phishing, spam, and malicious_url

[brijesh-elastic]

Proposed commit message

checkpoint_email: Populate additional ECS fields for the event types phishing, spam, and malicious_url

It will parse the email.*, destination.user.*, source.user.*, and checkpoint_email.event.scan_type fields
for the phishing, spam, and malicious_url event types. All these fields are parsed using
grok patterns on the checkpoint_email.event.data field.

Checklist

• I have reviewed tips for building integrations and this pull request is aligned with them.
• I have verified that all data streams collect metrics or logs.
• I have added an entry to my package's changelog.yml file.
• I have verified that Kibana version constraints are current according to guidelines.
• I have verified that any added dashboard complies with Kibana's Dashboard good practices

How to test this PR locally

• Clone integrations repo.
• Install elastic package locally.
• Start elastic stack using elastic-package.
• Move to integrations/packages/checkpoint_email directory.
• Run the following command to run tests.

elastic-package test

Related issues

• Relates [Check Point Harmony Email & Collaboration]: Improve event processing and ECS field population #14732

[elasticmachine]

Pinging @elastic/security-service-integrations (Team:Security-Service Integrations)

[elastic-vault-github-plugin-prod]

🚀 Benchmarks report

To see the full report comment with /test benchmark fullreport

[elasticmachine]

💚 Build Succeeded

• Buildkite Build
• Commit: fa61093

History

• 💚 Build #31338 succeeded 0414d7a
• 💚 Build #30775 succeeded 09fcb44

cc @brijesh-elastic

[elastic-sonarqube]

Quality Gate passed

Issues
0 New issues
0 Fixed issues
0 Accepted issues

Measures
0 Security Hotspots
98.8% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube

[elastic-vault-github-plugin-prod]

Package checkpoint_email - 1.2.0 containing this change is available at https://epr.elastic.co/package/checkpoint_email/1.2.0/