[fim]: add auto option for backend and make it the default one

packages/fim/changelog.yml

@@ -1,4 +1,9 @@
 # newer versions go on top
+- version: "1.15.1"
+  changes:
+    - description: Fix default backend to auto
+      type: bugfix
+      link: https://github.com/elastic/integrations/pulls/9702
 - version: "1.15.0"
   changes:
     - description: New event sourcing backends added

packages/fim/manifest.yml

@@ -1,7 +1,7 @@
 format_version: "3.0.0"
 name: fim
 title: "File Integrity Monitoring"
-version: "1.15.0"
+version: "1.15.1"
 description: "The File Integrity Monitoring integration reports filesystem changes in real time."
 type: integration
 categories:
@@ -79,15 +79,17 @@ vars:
       Forces a particular event source for file events on Linux. `fsnotify` does not provide
       user information.
     options:
-     - text: ebpf
-       value: ebpf
-     - text: fsnotify
-       value: fsnotify
-     - text: kprobes
-       value: kprobes
+      - text: auto
+        value: auto
+      - text: ebpf
+        value: ebpf
+      - text: fsnotify
+        value: fsnotify
+      - text: kprobes
+        value: kprobes
     show_user: true
     required: false
-    default: fsnotify
+    default: auto
   - name: max_file_size
     type: text
     title: File size limit