Add file.origin_referrer_url and file.origin_url to FileEvent

[AsuNa-jp]

Change Summary

This PR adds new file.origin_referrer_url and file.origin_url to the file event mapping. These fields will also be added to the ECS. (level: extended). The following is the ECS side PR.

• Add new fields file.origin_referrer_url & file.origin_url

To reviewers

Size of the fields
The two fields added in this PR are intended to store URL. Therefore, the default field size of 1024 bytes is insufficient. As a result, we want to set ignore_above to 8k bytes, if possible.

• ignore_above: 8192

Default Field
This field will not necessarily be included in all file events.
Therefore, I set it as default_field: false, but please let me know if this is incorrect.

About windows_file_open.md

As a result of running make, process.command_line was added to windows_file_open.md. If this behavior is unexpected, please let me know.

Sample values

• file.origin_referrer_url : https://example.com
• file.origin_url : https://example.com/file.zip

Release Target

8.15

Q/A

For mapping changes:

• I ran make after making the schema changes, and committed all changes

[pzl]

• no worries about the change in windows_file_open, maybe something was left behind in a previous PR? either way, things in custom_documentation have no ill-effect to the package functionality, so easy 👍 from me

will not necessarily be included in all file events.
Therefore, I set it as default_field: false

I don't believe that's what that setting does, but people doing fieldless-queries against our indices is probably rare, so no harm in using that setting anyway

• can you add the sample data to package/endpoint/data_stream/file/sample_event.json ? Easy 👍 after that

[AsuNa-jp]

Hi @pzl
Thank you very much for the review & feedback!
I added the sample data to package/endpoint/data_stream/file/sample_event.json !

[pzl]

🚢

[intxgo]

LGTM, I'm not sure why these fields are being added there if they're going to be included in ECS

[elasticmachine]

Package endpoint - 8.15.0 containing this change is available at https://epr.elastic.co/search?package=endpoint