hid_bravura_monitor,imperva,infoblox_*,zscalar_*: remove duplicate fields (elastic#4610)

Also make minor bugfixes in two packages.

* markdown syntax for proxy_url description in infoblox_bloxone_ddi
* normalization of x509.issuer.common_name in zpa

Author: efd6

packages/hid_bravura_monitor/changelog.yml

@@ -1,4 +1,9 @@
 # newer versions go on top
+- version: "1.3.1"
+  changes:
+    - description: Remove duplicate fields.
+      type: bugfix
+      link: https://github.com/elastic/integrations/pull/4610
 - version: "1.3.0"
   changes:
     - description: Update package to ECS 8.5.0.

packages/hid_bravura_monitor/data_stream/log/fields/agent.yml

@@ -199,9 +199,6 @@
 - name: input.type
   type: keyword
   description: Input type.
-- name: log.offset
-  type: long
-  description: Offset of the entry in the log file.
 - name: log.source.address
   type: keyword
   description: Source address from which the log event was read / sent from.

packages/hid_bravura_monitor/data_stream/log/fields/ecs.yml

@@ -46,8 +46,6 @@
   name: event.code
 - external: ecs
   name: event.created
-- external: ecs
-  name: event.created
 - external: ecs
   name: event.duration
 - external: ecs
@@ -202,8 +200,6 @@
   name: user.id
 - external: ecs
   name: user.name
-- external: ecs
-  name: server.domain
 - external: ecs
   name: server.address
 - external: ecs

packages/hid_bravura_monitor/data_stream/winlog/fields/agent.yml

@@ -130,13 +130,6 @@
       type: keyword
       ignore_above: 1024
       description: Host mac addresses.
-    - name: name
-      level: core
-      type: keyword
-      ignore_above: 1024
-      description: 'Name of the host.
-
-        It can contain what `hostname` returns on Unix systems, the fully qualified domain name, or a name specified by the user. The sender decides which value to use.'
     - name: os.family
       level: extended
       type: keyword

packages/hid_bravura_monitor/data_stream/winlog/fields/ecs.yml

@@ -12,8 +12,6 @@
   name: event.ingested
 - external: ecs
   name: event.kind
-- external: ecs
-  name: event.module
 - external: ecs
   name: event.outcome
 - external: ecs

packages/hid_bravura_monitor/docs/README.md

@@ -559,7 +559,7 @@ An example event for `winlog` looks as following:
 | event.dataset | Event dataset. | constant_keyword |
 | event.ingested | Timestamp when an event arrived in the central data store. This is different from `@timestamp`, which is when the event originally occurred.  It's also different from `event.created`, which is meant to capture the first time an agent saw the event. In normal conditions, assuming no tampering, the timestamps should chronologically look like this: `@timestamp` \< `event.created` \< `event.ingested`. | date |
 | event.kind | This is one of four ECS Categorization Fields, and indicates the highest level in the ECS category hierarchy. `event.kind` gives high-level information about what type of information the event contains, without being specific to the contents of the event. For example, values of this field distinguish alert events from metric events. The value of this field can be used to inform how these kinds of events should be handled. They may warrant different retention, different access control, it may also help understand whether the data coming in at a regular interval or not. | keyword |
-| event.module | Name of the module this data is coming from. If your monitoring agent supports the concept of modules or plugins to process events of a given source (e.g. Apache logs), `event.module` should contain the name of this module. | keyword |
+| event.module | Event module | constant_keyword |
 | event.outcome | This is one of four ECS Categorization Fields, and indicates the lowest level in the ECS category hierarchy. `event.outcome` simply denotes whether the event represents a success or a failure from the perspective of the entity that produced the event. Note that when a single transaction is described in multiple events, each event may populate different values of `event.outcome`, according to their perspective. Also note that in the case of a compound event (a single event that contains multiple logical events), this field should be populated with the value that best captures the overall success or failure from the perspective of the event producer. Further note that not all events will have an associated outcome. For example, this field is generally not populated for metric events, events with `event.type:info`, or any events for which an outcome does not make logical sense. | keyword |
 | event.provider | Source of the event. Event transports such as Syslog or the Windows Event Log typically mention the source of an event. It can be the name of the software that generated the event (e.g. Sysmon, httpd), or of a subsystem of the operating system (kernel, Microsoft-Windows-Security-Auditing). | keyword |
 | event.sequence | Sequence number of the event. The sequence number is a value published by some event sources, to make the exact ordering of events unambiguous, regardless of the timestamp precision. | long |

packages/hid_bravura_monitor/manifest.yml

@@ -1,6 +1,6 @@
 name: hid_bravura_monitor
 title: Hitachi ID Bravura Monitor
-version: "1.3.0"
+version: "1.3.1"
 categories: ["security"]
 release: ga
 description: Collect logs from Hitachi ID Security Fabric with Elastic Agent.

packages/imperva/changelog.yml

@@ -1,4 +1,9 @@
 # newer versions go on top
+- version: "0.11.1"
+  changes:
+    - description: Remove duplicate fields.
+      type: bugfix
+      link: https://github.com/elastic/integrations/pull/4610
 - version: "0.11.0"
   changes:
     - description: Update package to ECS 8.5.0.

packages/imperva/data_stream/securesphere/fields/base-fields.yml

@@ -15,9 +15,6 @@
   type: constant_keyword
   description: Event dataset
   value: imperva.securesphere
-- name: '@timestamp'
-  type: date
-  description: Event timestamp.
 - name: container.id
   description: Unique container id.
   ignore_above: 1024

packages/imperva/data_stream/securesphere/fields/ecs.yml

@@ -202,8 +202,6 @@
   name: source.subdomain
 - external: ecs
   name: source.top_level_domain
-- external: ecs
-  name: tags
 - external: ecs
   name: url.domain
 - external: ecs