Add event.provider to API events

[gabriellandau]

Change Summary

• Field event.provider is Unmapped in logs-endpoint.events.api Data Stream #630

Add event.provider to API events to fix the issue reported in #630

For mapping changes:

• I ran make after making the schema changes, and committed all changes
• If these field(s) are "exception"-able, I made a companion PR to Kibana adding it (see Readme)

[tomsonpl]

Lgtm 👍 no tests needed ?

[gabriellandau]

It's already in the sample document. Should we be doing additional testing?

endpoint-package/schemas/examples/v1/api_event_virtualprotect_windows.json

Line 19 in acece60

"provider": "Microsoft-Windows-Threat-Intelligence",

[pzl]

It's already in the sample document. Should we be doing additional testing?

I'm not sure this repo consumes any of the test files under schemas/ (but I could be wrong). But I know that the automated testing in this repo (incl. CI in PRs) use these files to validate schemas:

package/endpoint/data_stream/<stream name>/sample_event.json

if you can add a value there, this PR should be good to go

[gabriellandau]

Okay, thanks. It looks like we're already covered:

endpoint-package/package/endpoint/data_stream/api/sample_event.json

Line 71 in acece60

"provider": "Microsoft-Windows-Threat-Intelligence",