[ssi] Fix missing event categorization for packages

[brijesh-elastic]

Proposed commit message

ssi: Fix missing event categorization for packages

This PR includes the changes for below data streams:
- azure.graphactivitylogs
- jamf_pro.events
- sublime_security.audit
- github.issues
- google_workspace.gcp
- google_workspace.rules
- google_workspace.calendar
- google_workspace.group_enterprise
- google_workspace.context_aware_access
- google_workspace.meet
- google_workspace.chat
- google_workspace.chrome
- google_workspace.login
- google_workspace.device
- google_workspace.keep
- google_workspace.vault

This PR also fixes the flaky system tests in `google_workspace`. A race condition caused `google_workspace`
to fail when reading `credentials.json` before the `creds` container finished creating it. This was
resolved by adding a healthcheck to `creds` that checks for `credentials.json`, and
updating `google_workspace` to depend on `service_healthy`. This guarantees
the credentials file exists before the agent starts reading it.

Checklist

• I have reviewed tips for building integrations and this pull request is aligned with them.
• I have verified that all data streams collect metrics or logs.
• I have added an entry to my package's changelog.yml file.
• I have verified that Kibana version constraints are current according to guidelines.
• I have verified that any added dashboard complies with Kibana's Dashboard good practices

Related issues

• Relates [Bug] Multiple integrations missing event.category across events #18343

[infra-vault-gh-plugin-prod]

Pinging @elastic/security-service-integrations (Team:Security-Service Integrations)

[github-actions]

✅ Elastic Docs Style Checker (Vale)

No issues found on modified lines!

---

The Vale linter checks documentation changes against the Elastic Docs style guide. To use Vale locally or report issues, refer to Elastic style guide for Vale.

[elastic-vault-github-plugin-prod]

🚀 Benchmarks report

To see the full report comment with /test benchmark fullreport

[ShourieG]

@vera-review-bot review

[vera-review-bot]

Review summary

Issues found across the latest commits fb9cc32 — 1 medium

• 🟡 Narrowing the network category to five ring/call events leaves the stream and presentation events with an event.type but no event.category (link) (Unresolved)

Issues found across earlier commits fed75d7 — 6 medium, 2 low

• 🟡 The vault event.category script still writes [null] for unmapped event names (link) (Unresolved)
• 🟡 The event.type lookup scripts were not given the same null-guard as the event.category scripts, so unmapped event names still produce event.type: [null]. (link) (Unresolved)
• 🔵 password_breach was added to the event.type map but not the event.category map, so those events get an event.type with no event.category. (link) (Unresolved)
• 🟡 The issues pipeline sets event.type and now event.action but never sets event.category (link) (Unresolved)
• 🔵 The new comment documents mapping a closed issue to event.type deletion (link) (Unresolved)
• 🟡 The new ~90-line categorization script has only one pipeline test event, so the auth, iam and configuration branches are entirely untested (link) (Unresolved)
• 🟡 Twelve new conditional branches were added to the device pipeline but the test fixture still has only two events (link) (Unresolved)
• 🟡 Widening event.category: network to every Meet event mislabels non-network activity such as poll_created, hand_raised and send_chat_everyone (link) (Unresolved)

Issues found across earlier commits a3a239d…63d97a1 (41 commits) — 3 high, 6 medium, 2 low

• 🟠 The chat event.category lookup map is missing 9 event names that the event.type map already handles, so common Chat events (message_posted, message_edited, reaction_added, ...) still ship with no event.category. Add the missing keys to the category params map. (link) (Resolved)
• 🟠 Removing the unconditional event.type: info append while the replacement script only fires for mapped resources is a regression: audit records whose type is not in the new lookup now ship with no event.type and no event.category. Add a fallback for unmapped types. (link) (Resolved)
• 🟡 The vault event.category map omits search, search_count and get_count_operation, which the event.type map does handle, so those records ship with no event.category. Add the three keys to the category map. (link) (Resolved)
• 🟡 notification_triggered is handled by the calendar event.type map but is absent from the event.category map, so those events still ship with no event.category. Add it to the category params map. (link) (Resolved)
• 🟡 The new file category append covers only attachment events, leaving created_note, deleted_note and edited_note_content with an event.type but no event.category. Extend the condition to the note events. (link) (Resolved)
• 🟡 context_aware_access only categorizes the three ACCESS_DENY actions, so every other action — including the one in the data stream's own sample_event.json — still has no event.category or event.type. Add a fallback for unmatched actions. (link) (Unresolved)
• 🟡 sample_event.json adds an event.id field that the graphactivitylogs pipeline never sets, so the documented example event does not match real output. Remove event.id and regenerate the sample from a system test. (link) (Resolved)
• 🟡 types.add('info') runs unconditionally, so every Jamf event gets info alongside its real type — e.g. ["change","end","info"]. Only add info when the lookup produced no type. (link) (Resolved)
• 🔵 passkey_enrolled and passkey_removed are added to both the creation/deletion appends and the info list, producing contradictory event.type values. Remove them from the info list. (link) (Resolved)
• 🔵 ComputerAdded, MobileDeviceEnrolled and DeviceAddedToDEP are typed change, but each represents a record being created for the first time. Type them creation so they pair with the end used for un-enrolment. (link) (Resolved)
• 🟠 YAML syntax error in default.yml (link) (Resolved)

Issues found across earlier commits 6c76d69 — 1 high

• 🟠 YAML syntax error in default.yml (link) (Unresolved)

Issues found across earlier commits 91db7fe — 1 high

• 🟠 YAML syntax error in default.yml (link) (Unresolved)

A new commit triggers another review — at most once every 15 minutes. I skip the PR while it's approved or has merge conflicts.

🤖 AI-Generated Review | Vera Review Bot | 📚 Knowledge base: integration-skills

⚠️ Automated review — verify suggestions before applying.

[efd6]

LGTM but please wait for @kcreddy

[mergify]

Tick the box to add this pull request to the merge queue (same as @mergifyio queue).

• Queue this pull request

[kcreddy]

Nit only. LGTM.

[kcreddy]

Could also add event.reason based on state_reason.

[elastic-vault-github-plugin-prod]

✅ All changelog entries have the correct PR link.

[infra-vault-gh-plugin-prod]

💚 Build Succeeded

• Buildkite Build
• Commit: e8830e3

History

• 💚 Build #46810 succeeded fb9cc32
• 💚 Build #46804 succeeded fed75d7
• 💚 Build #46661 succeeded 63d97a1
• 💔 Build #46660 failed c88a4ae
• 💚 Build #46633 succeeded e092016
• 💔 Build #46632 failed 1ba474d

cc @brijesh-elastic

[elastic-vault-github-plugin-prod]

Package azure - 1.38.1 containing this change is available at https://epr.elastic.co/package/azure/1.38.1/

[elastic-vault-github-plugin-prod]

Package github - 2.25.2 containing this change is available at https://epr.elastic.co/package/github/2.25.2/

[elastic-vault-github-plugin-prod]

Package google_workspace - 3.5.2 containing this change is available at https://epr.elastic.co/package/google_workspace/3.5.2/

[elastic-vault-github-plugin-prod]

Package jamf_pro - 1.3.1 containing this change is available at https://epr.elastic.co/package/jamf_pro/1.3.1/

[elastic-vault-github-plugin-prod]

Package sublime_security - 1.12.2 containing this change is available at https://epr.elastic.co/package/sublime_security/1.12.2/