[fim] Incorrect ECS fields documented.

[marc-gr]

Some fields like user.*, network.*, or source.* are documented as part of the integration but the module never populates them. We should review the module output and either fix the documentation or enhance it to make what is documented consistent with real behavior.

[elasticmachine]

Pinging @elastic/security-external-integrations (Team:Security-External Integrations)

[alaudazzi]

@marc-gr if it's confirmed it's a doc issue, I'm happy to help.

[andrewkroh]

Also process.* are included and those are not reported by the integration.

[botelastic]

Hi! We just realized that we haven't looked into this issue in a while. We're sorry! We're labeling this issue as Stale to make it hit our filters and make sure we get back to it as soon as possible. In the meantime, it'd be extremely helpful if you could take a look at it as well and confirm its relevance. A simple comment with a nice emoji will be enough :+1. Thank you for your contribution!