wiz: fix result.evaluation to be lowercased in cloud_configuration_finding

[maxcold]

Proposed commit message

Cloud Security features in Kibana rely on the lowercase value of result.evaluation. Fixing cloud_configuration_finding ingest pipeline to provide the lowercased values

Checklist

• I have reviewed tips for building integrations and this pull request is aligned with them.
• I have verified that all data streams collect metrics or logs.
• I have added an entry to my package's changelog.yml file.
• I have verified that Kibana version constraints are current according to guidelines.

Author's Checklist

• [ ]

How to test this PR locally

see #10790

Related issues

• relates https://github.com/elastic/security-team/issues/9662

Screenshots

[JordanSh]

what do you think about changing our code to turn upper case to lower case where needed? just so 3Ps can have easier time integrating

[maxcold]

@JordanSh I considered it, we can maybe add it as a safety net, but my concern is that this duality will cause more headaches to the users. While we can update our code everywhere where we rely on the result.evaluation to lowercase the value, the Wiz data stream can be used not only from our flows. Eg. users can create dashboards, detection rules manually, etc. And they will need to remember that the value can be both lowercase and uppercase and fix it in each artifact they create. Eg. all detection rules will need to check for both values. This is not a good UX in my opinion. So I prefer to be more strict with the data schema.

[elasticmachine]

🚀 Benchmarks report

Package wiz 👍(2) 💚(0) 💔(2)

Expand to view

Data stream	Previous EPS	New EPS	Diff (%)	Result
cloud_configuration_finding	3636.36	2976.19	-660.17 (-18.15%)	💔
issue	3484.32	2053.39	-1430.93 (-41.07%)	💔

To see the full report comment with /test benchmark fullreport

[elasticmachine]

Pinging @elastic/security-service-integrations (Team:Security-Service Integrations)

[opauloh]

lgtm, cc @animehart

[efd6]

I see that the relevant field here existed prior to this change, but is not an ECS field. I do not see any discussion about introduction on a non-ECS field in the original change. Is there background for that?

[maxcold]

@efd6 the field result.evaluation is used by cloud_security_posture integration (the integration Cloud Security team owns) and Cloud Security UX in Kibana rely on this field heavily. You can find more context in this document https://docs.google.com/document/d/1govaQj_8LwUOLtk3zrcjCEvRgyKWRuC-TUihCrk04ao/edit

[elasticmachine]

💚 Build Succeeded

• Buildkite Build
• Commit: 3425945

History

• 💚 Build #15119 succeeded 22fbd0f

[elastic-sonarqube]

Quality Gate passed

Issues
0 New issues
0 Fixed issues
0 Accepted issues

Measures
0 Security Hotspots
100.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube

[elasticmachine]

Package wiz - 1.7.1 containing this change is available at https://epr.elastic.co/search?package=wiz