[Trellix_EDR_Cloud] Initial release for the Trellix EDR Cloud

[piyush-elastic]

What does this PR do?

• Updated data collection logic for the event data stream.
• Updated the ingest pipeline for the event data stream.
• Mapped fields according to the ECS schema and added Fields metadata in the appropriate .yml files.
• Added dashboards and visualizations.
• Updated test for pipeline for the event data stream.
• Updated system test cases for the event data stream.

Integration release checklist

This checklist is intended for integrations maintainers to ensure consistency
when creating or updating a Package, Module or Dataset for an Integration.

All changes

• Change follows the contributing guidelines
• Supported versions of the monitoring target is documented
• Supported operating systems are documented (if applicable)
• Integration or System tests exist
• Documentation exists
• Fields follow ECS and naming conventions
• At least a manual test with ES / Kibana / Agent has been performed.
• Required Kibana version set to: ^8.9.0

New Package

• Screenshot of the "Add Integration" page on Fleet added

Dashboards changes

• Dashboards exists
• Screenshots added or updated
• Data stream filters added to visualizations

Log dataset changes

• Pipeline tests exist (if applicable)
• Generated output for at least 1 log file exists
• Sample event (sample_event.json) exists

How to test this PR locally

• Clone integrations repo.
• Install elastic package locally.
• Start elastic stack using elastic-package.
• Move to integrations/packages/trellix_edr_cloud directory.
• Run the following command to run tests.

elastic-package test

Screenshots

2023/06/26 17:47:14 DEBUG Enable verbose logging
2023/06/26 17:47:15  INFO New version is available - v0.83.1. Download from: https://github.com/elastic/elastic-package/releases/tag/v0.83.1
Run test suite for the package
Run asset tests for the package
2023/06/26 17:47:15 DEBUG installing package...
2023/06/26 17:47:15 DEBUG POST https://127.0.0.1:5601/api/fleet/epm/packages/trellix_edr_cloud-0.1.0
--- Test results for package: trellix_edr_cloud - START ---
╭───────────────────┬─────────────┬───────────┬────────────────────────────────────────────────────────────────────────────┬────────┬──────────────╮
│ PACKAGE           │ DATA STREAM │ TEST TYPE │ TEST NAME                                                                  │ RESULT │ TIME ELAPSED │
├───────────────────┼─────────────┼───────────┼────────────────────────────────────────────────────────────────────────────┼────────┼──────────────┤
│ trellix_edr_cloud │             │ asset     │ dashboard trellix_edr_cloud-eb724520-0e93-11ee-9537-d3109e421092 is loaded │ PASS   │      1.318µs │
│ trellix_edr_cloud │ event       │ asset     │ index_template logs-trellix_edr_cloud.event is loaded                      │ PASS   │        117ns │
│ trellix_edr_cloud │ event       │ asset     │ ingest_pipeline logs-trellix_edr_cloud.event-0.1.0 is loaded               │ PASS   │        148ns │
╰───────────────────┴─────────────┴───────────┴────────────────────────────────────────────────────────────────────────────┴────────┴──────────────╯
--- Test results for package: trellix_edr_cloud - END   ---
Done
Run pipeline tests for the package
--- Test results for package: trellix_edr_cloud - START ---
╭───────────────────┬─────────────┬───────────┬────────────────┬────────┬──────────────╮
│ PACKAGE           │ DATA STREAM │ TEST TYPE │ TEST NAME      │ RESULT │ TIME ELAPSED │
├───────────────────┼─────────────┼───────────┼────────────────┼────────┼──────────────┤
│ trellix_edr_cloud │ event       │ pipeline  │ test-event.log │ PASS   │  35.778243ms │
╰───────────────────┴─────────────┴───────────┴────────────────┴────────┴──────────────╯
--- Test results for package: trellix_edr_cloud - END   ---
Done
Run static tests for the package
--- Test results for package: trellix_edr_cloud - START ---
╭───────────────────┬─────────────┬───────────┬──────────────────────────┬────────┬──────────────╮
│ PACKAGE           │ DATA STREAM │ TEST TYPE │ TEST NAME                │ RESULT │ TIME ELAPSED │
├───────────────────┼─────────────┼───────────┼──────────────────────────┼────────┼──────────────┤
│ trellix_edr_cloud │ event       │ static    │ Verify sample_event.json │ PASS   │  84.793848ms │
╰───────────────────┴─────────────┴───────────┴──────────────────────────┴────────┴──────────────╯
--- Test results for package: trellix_edr_cloud - END   ---
Done
Run system tests for the package
--- Test results for package: trellix_edr_cloud - START ---
No test results
--- Test results for package: trellix_edr_cloud - END   ---
Done

[elasticmachine]

💚 Build Succeeded

the below badges are clickable and redirect to their specific view in the CI or DOCS

Expand to view the summary

Build stats

• Start Time: 2023-08-02T06:23:59.360+0000

• Duration: 14 min 28 sec

Test stats 🧪

Test	Results
Failed	0
Passed	5
Skipped	0
Total	5

🤖 GitHub comments

Expand to view the GitHub comments

To re-run your PR in the CI, just comment with:

• /test : Re-trigger the build.

[elasticmachine]

🌐 Coverage report

Name	Metrics % (covered/total)	Diff
Packages	100.0% (1/1)	💚
Files	100.0% (1/1)	💚 2.828
Classes	100.0% (1/1)	💚 2.828
Methods	92.308% (12/13)	👍 0.089
Lines	92.696% (863/931)	👍 1.725
Conditionals	100.0% (0/0)	💚

[elasticmachine]

Pinging @elastic/security-external-integrations (Team:Security-External Integrations)

[kcreddy]

LGTM 👍🏼

[elasticmachine]

Package trellix_edr_cloud - 0.1.0 containing this change is available at https://epr.elastic.co/search?package=trellix_edr_cloud