[macOS] Security events

[ricardo-estc]

Add file path to Security events

Change Summary

• Updates macOS custom documentation for security events
• Enriches security events schema with a file path. It can be used for various actions, such as gatekeeper override

Sample values

Sample document:

Release Target

Q/A

For mapping changes:

• I ran make after making the schema changes, and committed all changes
• If these field(s) are "exception"-able, I made a companion PR to Kibana adding it (see Readme)
• If this is a metadata change, I also updated both transform destination schemas to match

For Transform changes:

• The new transform successfully starts in Kibana
• The corresponding transform destination schema was updated if necessary

[ferullo]

Is this change needed for 8.18 or 9.0?

[ashokaditya]

These three fields look out of alphabetical order.

[ashokaditya]

These file fields look out of alphabetical order.

[ricardo-estc]

@ferullo 9.0

[pzl]

Please update package/endpoint/data_stream/security/sample_event.json with example values for

• file.path
• file.code_signature.signing_id
• file.code_signature.team_id

Other than that, this looks ok to squeeze into 9.0, if we can merge soon

[ricardo-estc]

@ashokaditya reordered the fields in alphabetical order
@pzl updated sample_event.json

[pzl]

@ricardo-estc content of PR looks good, I think CI error is just about formatting on that sample event json. I'm guessing the space after the key names and before the :