Add memory_region to api events

[jdu2600]

Add missing [Target.]process.Ext.memory_region fields to api events.
These optional fields were introduced in 8.11.0

[elasticmachine]

💚 Build Succeeded

the below badges are clickable and redirect to their specific view in the CI or DOCS

Expand to view the summary

Build stats

• Start Time: 2023-11-06T02:14:10.090+0000

• Duration: 7 min 25 sec

🤖 GitHub comments

Expand to view the GitHub comments

To re-run your PR in the CI, just comment with:

• /test : Re-trigger the build.

[jdu2600]

🤔 Why do the generated files from my build have different whitespace to the existing files?
[Update] Rebuilt with parallelism... and the differences went away.

[gabriellandau]

Code LGTM but red build.

[jdu2600]

Code LGTM but red build.

The five Required items are green - which is sufficient I believe.

The failures look like the same KeyError: 'kibana.version' as last month - which is part of the buildkite migration.

[gabriellandau]

I'm not going to block a merge over this, but could you follow up with a PR that adds the new fields to the sample API event so their inclusion in enforced by make static-test?

[jdu2600]

api/sample_event.json

That's a credential_access API event sample - which I didn't want to overwrite.
I looked at that in my last PR, but couldn't see a way to add samples for all of the new API event variants.

[gabriellandau]

That's a credential_access API event sample - which I didn't want to overwrite.

They don't have to be real events with real meaning. The point is just to exercise the schema validation code.

[ferullo]

Should this be targeting 8.11 or main? Would we really release an updated endpoint package for 8.11?

[gabriellandau]

@jdu2600 the data's already there but not in the mapping, right? If so, that's arguably a bug.

[pzl]

Echoing @gabriellandau, I would love to see values for these fields added to the sample file.

The sample_event.json file does not need to semantically make any sense. It is for automated testing only to validate that a representative value for any given field, matches what the typing is set in the data stream mapping. The end result, is that it will look like a union of every possible event sample in one document, yes. That is OK here.

Buildkite migration is blocked, so it's in purgatory still, will be red until a dependency is fixed. It can be safely ignored. The rest of the statuses are green.

It seems like this is entirely additions, so backporting is not out of the question for 8.11. Just ping the defend workflows team if we need to cut a release

[jdu2600]

Updated the sample file (including fields added in #427).

[pzl]

we should merge this to main, and then it's a manual backport step to 8.11 branch

[jdu2600]

I've re-targeted this PR to main.

[elasticmachine]

Package endpoint - 8.12.0 containing this change is available at https://epr.elastic.co/search?package=endpoint