Added registry rollback fields associated with recovered values

[bit-envoy]

Change Summary

Sample document:

        {
            "@timestamp": "2023-04-13T16:15:16.0Z",
            "action": {
                "action": "registry_rollback",
                "key": {
                    "actions": [
                        "Modified"
                    ],
                    "path": "\\REGISTRY\\MACHINE\\SOFTWARE\\WOW6432Node\\TestRollback.valuetest",
                    "values": [
                        {
                            "actions": [
                                "Deleted"
                            ],
                            "name": "SomeValue"
                        }
                    ]
                }
            },
            "message": "Successful production registry rollback",
            "result": 0
        }

Release Target

Q/A

For mapping changes:

• I ran make after making the schema changes, and committed all changes
• If these field(s) are "exception"-able, I made a companion PR to Kibana adding it (see Readme)
• If this is a metadata change, I also updated both transform destination schemas to match

For Transform changes:

• The new transform successfully starts in Kibana
• The corresponding transform destination schema was updated if necessary

[elasticmachine]

💚 Build Succeeded

the below badges are clickable and redirect to their specific view in the CI or DOCS

Expand to view the summary

Build stats

• Start Time: 2023-04-13T17:49:47.681+0000

• Duration: 8 min 55 sec

🤖 GitHub comments

Expand to view the GitHub comments

To re-run your PR in the CI, just comment with:

• /test : Re-trigger the build.

[pzl]

This looks good. Can you please add the sample values to this file?

https://github.com/elastic/endpoint-package/blob/main/package/endpoint/data_stream/alerts/sample_event.json

this includes the schema in automated testing for us

[bit-envoy]

blob/main/package/endpoint/data_stream/alerts/sample_event.json

Added.

[elasticmachine]

Package endpoint - 8.8.0 containing this change is available at https://epr.elastic.co/search?package=endpoint