ETW Threat-Intelligence API Event metrics

[jdu2600]

Change Summary

Adds new metrics fields for the API Event type and the ETW Threat-Intelligence API Event provider.

Endpoint.metrics.documents_volume.api_events.sent_bytes
Endpoint.metrics.documents_volume.api_events.sent_count
Endpoint.metrics.documents_volume.api_events.suppressed_bytes
Endpoint.metrics.documents_volume.api_events.suppressed_count
Endpoint.metrics.documents_volume.api_events.sources[].source
Endpoint.metrics.documents_volume.api_events.sources[].sent_bytes
Endpoint.metrics.documents_volume.api_events.sources[].sent_count
Endpoint.metrics.documents_volume.api_events.sources[].suppressed_bytes
Endpoint.metrics.documents_volume.api_events.sources[].suppressed_count
Endpoint.metrics.system_impact.threat_intelligence_events.week_idle_ms
Endpoint.metrics.system_impact.threat_intelligence_events.week_ms

Release Target

These events are diagnostic in 8.8 and will be released in a future version.

For mapping changes:

• I ran make after making the schema changes, and committed all changes
• If these field(s) are "exception"-able, I made a companion PR to Kibana adding it (see Readme)
• If this is a metadata change, I also updated both transform destination schemas to match

[elasticmachine]

💚 Build Succeeded

the below badges are clickable and redirect to their specific view in the CI or DOCS

Expand to view the summary

Build stats

• Start Time: 2023-05-04T07:16:14.386+0000

• Duration: 8 min 49 sec

🤖 GitHub comments

Expand to view the GitHub comments

To re-run your PR in the CI, just comment with:

• /test : Re-trigger the build.

[intxgo]

LGTM

[kevinlog]

Can you add new mappings for these instead of renaming? The reason being is that there will still be old Endpoints that stream data to these fields.

[jdu2600]

Ah. Sorry for not providing the background on this. I've been removing vestigial code in endpoint-dev - and just did the same here automatically.

So Endpoint has never generated etw_events metrics. This appears to have been added optimistically because of a feature in endgame and never used.
cc: @nfritts

[kevinlog]

thanks for the explanation. This should be fine to merge as long as we're sure there's no backwards compatibility issues with older Endpoints

[jdu2600]

This should have been keyword.
See #373

[elasticmachine]

Package endpoint - 8.9.0 containing this change is available at https://epr.elastic.co/search?package=endpoint