[Carbon Black Cloud] Cleanup fields based on Alert API doc

[kcreddy]

What does this PR do?

• Cleanup fields not part of the Alert APIs anymore. Removed following fields:
  • event.url as there is no alert_url field anymore in the API doc.
  • carbon_black_cloud.alert.device.external_ip as there is no device_external_ip field anymore in the API doc.
  • carbon_black_cloud.alert.device.internal_ip as there is no device_internal_ip field anymore in the API doc.

Checklist

• I have reviewed tips for building integrations and this pull request is aligned with them.
• I have verified that all data streams collect metrics or logs.
• I have added an entry to my package's changelog.yml file.
• I have verified that Kibana version constraints are current according to guidelines.

How to test this PR locally

elastic-package stack down && elastic-package build && elastic-package stack up --version=8.8.0-SNAPSHOT -d -v && eval "$(elastic-package stack shellinit)" && elastic-package test -v

Run test suite for the package
Run pipeline tests for the package
--- Test results for package: carbon_black_cloud - START ---
╭────────────────────┬─────────────────────────────┬───────────┬──────────────────────────────────────┬────────┬──────────────╮
│ PACKAGE            │ DATA STREAM                 │ TEST TYPE │ TEST NAME                            │ RESULT │ TIME ELAPSED │
├────────────────────┼─────────────────────────────┼───────────┼──────────────────────────────────────┼────────┼──────────────┤
│ carbon_black_cloud │ alert                       │ pipeline  │ test-alert.log                       │ PASS   │  26.815541ms │
│ carbon_black_cloud │ asset_vulnerability_summary │ pipeline  │ test-asset-vulnerability-summary.log │ PASS   │     7.3745ms │
│ carbon_black_cloud │ audit                       │ pipeline  │ test-audit.log                       │ PASS   │   5.084542ms │
│ carbon_black_cloud │ endpoint_event              │ pipeline  │ test-endpoint-event.log              │ PASS   │  22.879208ms │
│ carbon_black_cloud │ watchlist_hit               │ pipeline  │ test-watchlist-hit.log               │ PASS   │  11.364584ms │
╰────────────────────┴─────────────────────────────┴───────────┴──────────────────────────────────────┴────────┴──────────────╯
--- Test results for package: carbon_black_cloud - END   ---
Done
Run static tests for the package
--- Test results for package: carbon_black_cloud - START ---
╭────────────────────┬─────────────────────────────┬───────────┬──────────────────────────┬────────┬──────────────╮
│ PACKAGE            │ DATA STREAM                 │ TEST TYPE │ TEST NAME                │ RESULT │ TIME ELAPSED │
├────────────────────┼─────────────────────────────┼───────────┼──────────────────────────┼────────┼──────────────┤
│ carbon_black_cloud │ alert                       │ static    │ Verify sample_event.json │ PASS   │  37.099125ms │
│ carbon_black_cloud │ asset_vulnerability_summary │ static    │ Verify sample_event.json │ PASS   │  35.396875ms │
│ carbon_black_cloud │ audit                       │ static    │ Verify sample_event.json │ PASS   │  34.135208ms │
│ carbon_black_cloud │ endpoint_event              │ static    │ Verify sample_event.json │ PASS   │    35.8375ms │
│ carbon_black_cloud │ watchlist_hit               │ static    │ Verify sample_event.json │ PASS   │  35.425917ms │
╰────────────────────┴─────────────────────────────┴───────────┴──────────────────────────┴────────┴──────────────╯
--- Test results for package: carbon_black_cloud - END   ---
Done
--- Test results for package: carbon_black_cloud - START ---
╭────────────────────┬─────────────────────────────┬───────────┬───────────┬────────┬───────────────╮
│ PACKAGE            │ DATA STREAM                 │ TEST TYPE │ TEST NAME │ RESULT │  TIME ELAPSED │
├────────────────────┼─────────────────────────────┼───────────┼───────────┼────────┼───────────────┤
│ carbon_black_cloud │ alert                       │ system    │ default   │ PASS   │ 35.602286042s │
│ carbon_black_cloud │ asset_vulnerability_summary │ system    │ default   │ PASS   │ 37.834153833s │
│ carbon_black_cloud │ audit                       │ system    │ default   │ PASS   │ 35.745025709s │
╰────────────────────┴─────────────────────────────┴───────────┴───────────┴────────┴───────────────╯
--- Test results for package: carbon_black_cloud - END   ---
Done
Run asset tests for the package
2023/04/19 22:20:57 DEBUG installing package...
2023/04/19 22:20:57 DEBUG POST https://127.0.0.1:5601/api/fleet/epm/packages/carbon_black_cloud-1.7.1
--- Test results for package: carbon_black_cloud - START ---
╭────────────────────┬─────────────────────────────┬───────────┬─────────────────────────────────────────────────────────────────────────────────────┬────────┬──────────────╮
│ PACKAGE            │ DATA STREAM                 │ TEST TYPE │ TEST NAME                                                                           │ RESULT │ TIME ELAPSED │
├────────────────────┼─────────────────────────────┼───────────┼─────────────────────────────────────────────────────────────────────────────────────┼────────┼──────────────┤
│ carbon_black_cloud │                             │ asset     │ dashboard carbon_black_cloud-06a8d7f0-3b04-11ed-a8e8-41eb8778c6de is loaded         │ PASS   │      1.125µs │
│ carbon_black_cloud │                             │ asset     │ dashboard carbon_black_cloud-0954fb80-3a5c-11ed-a8e8-41eb8778c6de is loaded         │ PASS   │        750ns │
│ carbon_black_cloud │                             │ asset     │ dashboard carbon_black_cloud-44209d90-3a7b-11ed-a8e8-41eb8778c6de is loaded         │ PASS   │        208ns │
│ carbon_black_cloud │                             │ asset     │ dashboard carbon_black_cloud-4d08ffd0-3b19-11ed-a8e8-41eb8778c6de is loaded         │ PASS   │        125ns │
│ carbon_black_cloud │                             │ asset     │ dashboard carbon_black_cloud-a1f898e0-3a72-11ed-a8e8-41eb8778c6de is loaded         │ PASS   │        125ns │
│ carbon_black_cloud │                             │ asset     │ search carbon_black_cloud-4ab86f30-3b10-11ed-a8e8-41eb8778c6de is loaded            │ PASS   │        125ns │
│ carbon_black_cloud │                             │ asset     │ search carbon_black_cloud-9a5bb310-3a7c-11ed-a8e8-41eb8778c6de is loaded            │ PASS   │         84ns │
│ carbon_black_cloud │                             │ asset     │ search carbon_black_cloud-b23c6730-3a6e-11ed-a8e8-41eb8778c6de is loaded            │ PASS   │         84ns │
│ carbon_black_cloud │                             │ asset     │ search carbon_black_cloud-d6f70aa0-3b20-11ed-a8e8-41eb8778c6de is loaded            │ PASS   │         84ns │
│ carbon_black_cloud │                             │ asset     │ search carbon_black_cloud-e16671a0-3a77-11ed-a8e8-41eb8778c6de is loaded            │ PASS   │         84ns │
│ carbon_black_cloud │ alert                       │ asset     │ index_template logs-carbon_black_cloud.alert is loaded                              │ PASS   │        292ns │
│ carbon_black_cloud │ alert                       │ asset     │ ingest_pipeline logs-carbon_black_cloud.alert-1.7.1 is loaded                       │ PASS   │        125ns │
│ carbon_black_cloud │ asset_vulnerability_summary │ asset     │ index_template logs-carbon_black_cloud.asset_vulnerability_summary is loaded        │ PASS   │        250ns │
│ carbon_black_cloud │ asset_vulnerability_summary │ asset     │ ingest_pipeline logs-carbon_black_cloud.asset_vulnerability_summary-1.7.1 is loaded │ PASS   │        167ns │
│ carbon_black_cloud │ audit                       │ asset     │ index_template logs-carbon_black_cloud.audit is loaded                              │ PASS   │        250ns │
│ carbon_black_cloud │ audit                       │ asset     │ ingest_pipeline logs-carbon_black_cloud.audit-1.7.1 is loaded                       │ PASS   │        208ns │
│ carbon_black_cloud │ endpoint_event              │ asset     │ index_template logs-carbon_black_cloud.endpoint_event is loaded                     │ PASS   │        209ns │
│ carbon_black_cloud │ endpoint_event              │ asset     │ ingest_pipeline logs-carbon_black_cloud.endpoint_event-1.7.1 is loaded              │ PASS   │        167ns │
│ carbon_black_cloud │ watchlist_hit               │ asset     │ index_template logs-carbon_black_cloud.watchlist_hit is loaded                      │ PASS   │        208ns │
│ carbon_black_cloud │ watchlist_hit               │ asset     │ ingest_pipeline logs-carbon_black_cloud.watchlist_hit-1.7.1 is loaded               │ PASS   │        125ns │
╰────────────────────┴─────────────────────────────┴───────────┴─────────────────────────────────────────────────────────────────────────────────────┴────────┴──────────────╯
--- Test results for package: carbon_black_cloud - END   ---
Done

Related issues

• Closes [Carbon Black Cloud] | Remove missing fields based on API doc #5208

Screenshots

[elasticmachine]

💚 Build Succeeded

the below badges are clickable and redirect to their specific view in the CI or DOCS

Expand to view the summary

Build stats

• Start Time: 2023-04-20T05:59:26.678+0000

• Duration: 16 min 24 sec

Test stats 🧪

Test	Results
Failed	0
Passed	33
Skipped	0
Total	33

🤖 GitHub comments

Expand to view the GitHub comments

To re-run your PR in the CI, just comment with:

• /test : Re-trigger the build.

[elasticmachine]

🌐 Coverage report

Name	Metrics % (covered/total)	Diff
Packages	100.0% (5/5)	💚
Files	100.0% (5/5)	💚 3.156
Classes	100.0% (5/5)	💚 3.156
Methods	95.238% (60/63)	👍 3.018
Lines	92.434% (1576/1705)	👍 1.131
Conditionals	100.0% (0/0)	💚

[efd6]

Can you note in the commit the provenance of the new test samples. I'm assuming that they are just the old ones with the defunct fields removed.

[kcreddy]

Hey @efd6 I dont have the new test samples.
This issue was created after an SDH where customer found ambiguity with the presence of additional fields inside our docs, but not present in the Carbon Black Cloud Alert API.

I'm assuming that they are just the old ones with the defunct fields removed.

Yes

[elasticmachine]

Package carbon_black_cloud - 1.7.1 containing this change is available at https://epr.elastic.co/search?package=carbon_black_cloud