[carbon_black_cloud] Add Carbon Black Cloud package.

[darshan-elastic]

What does this PR do?

• Generated the skeleton of the Carbon Black Cloud integration package.
• Added 5 data streams (Alert, Audit, Endpoint Event, Watchlist Hit, Asset Vulnerability Summary).
• Added data collection logic for all 5 data streams.
• Added the ingest pipeline for all the data streams.
• Mapped fields according to the ECS schema and added Fields metadata in the appropriate yml files
• Added dashboards and visualizations.
• Added test for pipeline for all the data streams.
• Added system test cases for data streams that uses httpjson.

Checklist

• I have reviewed tips for building integrations and this pull request is aligned with them.
• I have verified that all data streams collect metrics or logs.
• I have added an entry to my package's changelog.yml file.
• I have verified that Kibana version constraints are current according to guidelines.

How to test this PR locally

• Clone integrations repo.
• Install elastic-package locally.
• Start elastic stack using elastic-package.
• Move to integrations/packages/carbon_black_cloud directory.
• Run the following command to run tests.
  elastic-package test

Screenshots

[elasticmachine]

💚 Build Succeeded

the below badges are clickable and redirect to their specific view in the CI or DOCS

Expand to view the summary

Build stats

• Start Time: 2022-04-07T04:56:09.111+0000

• Duration: 15 min 42 sec

Test stats 🧪

Test	Results
Failed	0
Passed	97
Skipped	0
Total	97

🤖 GitHub comments

To re-run your PR in the CI, just comment with:

• /test : Re-trigger the build.

[elasticmachine]

Pinging @elastic/security-external-integrations (Team:Security-External Integrations)

[andrewkroh]

/test

[andrewkroh]

/test

[andrewkroh]

/test

[jsoriano]

/test

[jamiehynds]

@andrewkroh looks like the code owner was accidentally set to the ecosystems team. Not sure if we can update it, or if it has to be done by @darshan-elastic..

[darshan-elastic]

@jamiehynds, I'm also not able to update the code owners in the PR.

[andrewkroh]

/test

[mtojek]

CODEOWNERS looks good.

[CyberTaoFlow]

I wanted to mention in environments where the hosts are windows machines that are joined to an AD domain the values that the ingest pipeline place into host.name and/or host.hostname and user.name contain the AD domain name in NT format:

TESTORG\user

I add the GROK processors following to correct that :

  {
    "rename": {
      "field": "json.device_name",
      "target_field": "host.hostname",
      "ignore_missing": true
    }
  },
  {
    "grok": {
      "field": "host.hostname",
      "patterns": [
        "^(%{DATA:user.domain})\\\\(%{GREEDYDATA:host.name})$"
      ],
      "ignore_missing": true,
      "ignore_failure": true
    }
  },
  {
    "grok": {
      "field": "json.device_username",
      "patterns": [
        "^(%{DATA:user.domain})\\\\(%{GREEDYDATA:user.name})$"
      ],
      "ignore_missing": true,
      "ignore_failure": true
    }
  },

[jamiehynds]

Thanks @CyberTaoFlow for the feedback. We've addressed your feedback via this PR: #3106