[ECS] Update SEI packages to ECS 8.9 (Part 2)

packages/cyberark_pta/_dev/build/build.yml

@@ -1,3 +1,3 @@
 dependencies:
   ecs:
-    reference: git@v8.8.0
+    reference: git@v8.9.0

packages/cyberark_pta/changelog.yml

@@ -1,4 +1,9 @@
 # newer versions go on top
+- version: "1.4.0"
+  changes:
+    - description: Update package to ECS 8.9.0.
+      type: enhancement
+      link: https://github.com/elastic/integrations/pull/7109
 - version: "1.3.0"
   changes:
     - description: Update package to ECS 8.8.0.

packages/cyberark_pta/data_stream/events/_dev/test/pipeline/test-active-dormant-user.json-expected.json

@@ -44,7 +44,7 @@
                 }
             },
             "ecs": {
-                "version": "8.8.0"
+                "version": "8.9.0"
             },
             "event": {
                 "code": "26",

packages/cyberark_pta/data_stream/events/_dev/test/pipeline/test-suspected-cred-theft.json-expected.json

@@ -44,7 +44,7 @@
                 }
             },
             "ecs": {
-                "version": "8.8.0"
+                "version": "8.9.0"
             },
             "event": {
                 "code": "1",

packages/cyberark_pta/data_stream/events/elasticsearch/ingest_pipeline/default.yml

@@ -4,7 +4,7 @@ description: Pipeline for CyberArk PTA
 processors:
   - set:
       field: ecs.version
-      value: '8.8.0'
+      value: '8.9.0'
   - set:
       field: event.action
       value: "{{cef.extensions.deviceCustomString5}}"

packages/cyberark_pta/data_stream/events/sample_event.json

@@ -55,7 +55,7 @@
         }
     },
     "ecs": {
-        "version": "8.8.0"
+        "version": "8.9.0"
     },
     "elastic_agent": {
         "id": "61c2aa93-e34e-4412-bd9b-ce85257847de",

packages/cyberark_pta/docs/README.md

@@ -287,7 +287,7 @@ An example event for pta looks as following:
 | destination.user.name.text | Multi-field of `destination.user.name`. | match_only_text |
 | ecs.version | ECS version this event conforms to. `ecs.version` is a required field and must exist in all events. When querying across multiple indices -- which may conform to slightly different ECS versions -- this field lets integrations adjust to the schema version of the events. | keyword |
 | event.action | The action captured by the event. This describes the information in the event. It is more specific than `event.category`. Examples are `group-add`, `process-started`, `file-created`. The value is normally defined by the implementer. | keyword |
-| event.created | event.created contains the date/time when the event was first read by an agent, or by your pipeline. This field is distinct from @timestamp in that @timestamp typically contain the time extracted from the original event. In most situations, these two timestamps will be slightly different. The difference can be used to calculate the delay between your source generating an event, and the time when your agent first processed it. This can be used to monitor your agent's or pipeline's ability to keep up with your event source. In case the two timestamps are identical, @timestamp should be used. | date |
+| event.created | `event.created` contains the date/time when the event was first read by an agent, or by your pipeline. This field is distinct from `@timestamp` in that `@timestamp` typically contain the time extracted from the original event. In most situations, these two timestamps will be slightly different. The difference can be used to calculate the delay between your source generating an event, and the time when your agent first processed it. This can be used to monitor your agent's or pipeline's ability to keep up with your event source. In case the two timestamps are identical, `@timestamp` should be used. | date |
 | event.dataset | Event dataset | constant_keyword |
 | event.id | Unique ID to describe the event. | keyword |
 | event.module | Event module | constant_keyword |

packages/cyberark_pta/manifest.yml

@@ -1,6 +1,6 @@
 name: cyberark_pta
 title: Cyberark Privileged Threat Analytics
-version: "1.3.0"
+version: "1.4.0"
 description: Collect security logs from Cyberark PTA integration.
 type: integration
 format_version: 2.7.0

packages/cyberarkpas/_dev/build/build.yml

@@ -1,3 +1,3 @@
 dependencies:
   ecs:
-    reference: git@v8.8.0
+    reference: git@v8.9.0

packages/cyberarkpas/changelog.yml

@@ -1,4 +1,9 @@
 # newer versions go on top
+- version: "2.13.0"
+  changes:
+    - description: Update package to ECS 8.9.0.
+      type: enhancement
+      link: https://github.com/elastic/integrations/pull/7109
 - version: "2.12.0"
   changes:
     - description: Convert visualizations to lens.

packages/cyberarkpas/data_stream/audit/_dev/test/pipeline/test-105-add-file-category.log-expected.json

@@ -25,7 +25,7 @@
                 "ip": "10.0.1.20"
             },
             "ecs": {
-                "version": "8.8.0"
+                "version": "8.9.0"
             },
             "event": {
                 "action": "add file category",
@@ -87,7 +87,7 @@
                 }
             },
             "ecs": {
-                "version": "8.8.0"
+                "version": "8.9.0"
             },
             "event": {
                 "action": "add file category",
@@ -154,7 +154,7 @@
                 }
             },
             "ecs": {
-                "version": "8.8.0"
+                "version": "8.9.0"
             },
             "event": {
                 "action": "add file category",
@@ -222,7 +222,7 @@
                 }
             },
             "ecs": {
-                "version": "8.8.0"
+                "version": "8.9.0"
             },
             "event": {
                 "action": "add file category",
@@ -289,7 +289,7 @@
                 }
             },
             "ecs": {
-                "version": "8.8.0"
+                "version": "8.9.0"
             },
             "event": {
                 "action": "add file category",
@@ -357,7 +357,7 @@
                 }
             },
             "ecs": {
-                "version": "8.8.0"
+                "version": "8.9.0"
             },
             "event": {
                 "action": "add file category",

packages/cyberarkpas/data_stream/audit/_dev/test/pipeline/test-106-update-file-category.log-expected.json

@@ -25,7 +25,7 @@
                 "ip": "10.0.1.20"
             },
             "ecs": {
-                "version": "8.8.0"
+                "version": "8.9.0"
             },
             "event": {
                 "action": "update file category",
@@ -87,7 +87,7 @@
                 }
             },
             "ecs": {
-                "version": "8.8.0"
+                "version": "8.9.0"
             },
             "event": {
                 "action": "update file category",
@@ -154,7 +154,7 @@
                 }
             },
             "ecs": {
-                "version": "8.8.0"
+                "version": "8.9.0"
             },
             "event": {
                 "action": "update file category",
@@ -222,7 +222,7 @@
                 }
             },
             "ecs": {
-                "version": "8.8.0"
+                "version": "8.9.0"
             },
             "event": {
                 "action": "update file category",
@@ -290,7 +290,7 @@
                 }
             },
             "ecs": {
-                "version": "8.8.0"
+                "version": "8.9.0"
             },
             "event": {
                 "action": "update file category",
@@ -358,7 +358,7 @@
                 }
             },
             "ecs": {
-                "version": "8.8.0"
+                "version": "8.9.0"
             },
             "event": {
                 "action": "update file category",

packages/cyberarkpas/data_stream/audit/_dev/test/pipeline/test-107-delete-file-category.log-expected.json

@@ -26,7 +26,7 @@
                 "ip": "10.0.1.20"
             },
             "ecs": {
-                "version": "8.8.0"
+                "version": "8.9.0"
             },
             "event": {
                 "action": "delete file category",

packages/cyberarkpas/data_stream/audit/_dev/test/pipeline/test-124-rename-file.log-expected.json

@@ -24,7 +24,7 @@
                 "ip": "10.0.1.20"
             },
             "ecs": {
-                "version": "8.8.0"
+                "version": "8.9.0"
             },
             "event": {
                 "action": "rename file",

packages/cyberarkpas/data_stream/audit/_dev/test/pipeline/test-125-rename-file-cont.log-expected.json

@@ -24,7 +24,7 @@
                 "ip": "10.0.1.20"
             },
             "ecs": {
-                "version": "8.8.0"
+                "version": "8.9.0"
             },
             "event": {
                 "action": "rename file (cont.)",

packages/cyberarkpas/data_stream/audit/_dev/test/pipeline/test-126-unlock-file.log-expected.json

@@ -18,7 +18,7 @@
                 }
             },
             "ecs": {
-                "version": "8.8.0"
+                "version": "8.9.0"
             },
             "event": {
                 "action": "unlock file",

packages/cyberarkpas/data_stream/audit/_dev/test/pipeline/test-130-cpm-disable-password.log-expected.json

@@ -43,7 +43,7 @@
                 }
             },
             "ecs": {
-                "version": "8.8.0"
+                "version": "8.9.0"
             },
             "event": {
                 "action": "cpm disable password",

packages/cyberarkpas/data_stream/audit/_dev/test/pipeline/test-178-get-user-s-details.log-expected.json

@@ -18,7 +18,7 @@
                 }
             },
             "ecs": {
-                "version": "8.8.0"
+                "version": "8.9.0"
             },
             "event": {
                 "action": "get user's details",

packages/cyberarkpas/data_stream/audit/_dev/test/pipeline/test-180-add-user.log-expected.json

@@ -17,7 +17,7 @@
                 }
             },
             "ecs": {
-                "version": "8.8.0"
+                "version": "8.9.0"
             },
             "event": {
                 "action": "add user",
@@ -95,7 +95,7 @@
                 }
             },
             "ecs": {
-                "version": "8.8.0"
+                "version": "8.9.0"
             },
             "event": {
                 "action": "add user",
@@ -173,7 +173,7 @@
                 }
             },
             "ecs": {
-                "version": "8.8.0"
+                "version": "8.9.0"
             },
             "event": {
                 "action": "add user",
@@ -251,7 +251,7 @@
                 }
             },
             "ecs": {
-                "version": "8.8.0"
+                "version": "8.9.0"
             },
             "event": {
                 "action": "add user",
@@ -329,7 +329,7 @@
                 }
             },
             "ecs": {
-                "version": "8.8.0"
+                "version": "8.9.0"
             },
             "event": {
                 "action": "add user",
@@ -407,7 +407,7 @@
                 }
             },
             "ecs": {
-                "version": "8.8.0"
+                "version": "8.9.0"
             },
             "event": {
                 "action": "add user",
@@ -485,7 +485,7 @@
                 }
             },
             "ecs": {
-                "version": "8.8.0"
+                "version": "8.9.0"
             },
             "event": {
                 "action": "add user",
@@ -564,7 +564,7 @@
                 }
             },
             "ecs": {
-                "version": "8.8.0"
+                "version": "8.9.0"
             },
             "event": {
                 "action": "add user",
@@ -643,7 +643,7 @@
                 }
             },
             "ecs": {
-                "version": "8.8.0"
+                "version": "8.9.0"
             },
             "event": {
                 "action": "add user",
@@ -722,7 +722,7 @@
                 }
             },
             "ecs": {
-                "version": "8.8.0"
+                "version": "8.9.0"
             },
             "event": {
                 "action": "add user",
@@ -801,7 +801,7 @@
                 }
             },
             "ecs": {
-                "version": "8.8.0"
+                "version": "8.9.0"
             },
             "event": {
                 "action": "add user",
@@ -880,7 +880,7 @@
                 }
             },
             "ecs": {
-                "version": "8.8.0"
+                "version": "8.9.0"
             },
             "event": {
                 "action": "add user",

packages/cyberarkpas/data_stream/audit/_dev/test/pipeline/test-181-update-safe.log-expected.json

@@ -17,7 +17,7 @@
                 }
             },
             "ecs": {
-                "version": "8.8.0"
+                "version": "8.9.0"
             },
             "event": {
                 "action": "update safe",

packages/cyberarkpas/data_stream/audit/_dev/test/pipeline/test-185-add-safe.log-expected.json

@@ -17,7 +17,7 @@
                 }
             },
             "ecs": {
-                "version": "8.8.0"
+                "version": "8.9.0"
             },
             "event": {
                 "action": "add safe",
@@ -80,7 +80,7 @@
                 }
             },
             "ecs": {
-                "version": "8.8.0"
+                "version": "8.9.0"
             },
             "event": {
                 "action": "add safe",

packages/cyberarkpas/data_stream/audit/_dev/test/pipeline/test-187-add-folder.log-expected.json

@@ -18,7 +18,7 @@
                 }
             },
             "ecs": {
-                "version": "8.8.0"
+                "version": "8.9.0"
             },
             "event": {
                 "action": "add folder",
@@ -85,7 +85,7 @@
                 }
             },
             "ecs": {
-                "version": "8.8.0"
+                "version": "8.9.0"
             },
             "event": {
                 "action": "add folder",