[Okta] Add event categories and types

packages/okta/changelog.yml

@@ -1,4 +1,9 @@
 # newer versions go on top
+- version: "3.11.0"
+  changes:
+    - description: Sets the ECS event categorization fields for system data stream.
+      type: enhancement
+      link: https://github.com/elastic/integrations/pull/1
 - version: "3.10.3"
   changes:
     - description: Optimize API pagination to prevent unnecessary requests when fewer logs than the limit are returned, reducing rate limit token consumption.

packages/okta/data_stream/system/_dev/test/pipeline/test-okta-system-events.json-expected.json

@@ -26,8 +26,8 @@
             "event": {
                 "action": "user.session.end",
                 "category": [
-                    "authentication",
-                    "session"
+                    "session",
+                    "authentication"
                 ],
                 "id": "faf7398a-4f77-11ea-97fb-5925e98228bd",
                 "kind": "event",
@@ -136,6 +136,9 @@
                     "name": "[email protected]"
                 }
             },
+            "tags": [
+                "event-hook-eligiblesessionuser"
+            ],
             "user": {
                 "email": "[email protected]",
                 "full_name": "xxxxxx",

packages/okta/data_stream/system/elasticsearch/ingest_pipeline/default.yml

@@ -177,6 +177,9 @@ processors:
       value: info
       if: '["policy.evaluate_sign_on"].contains(ctx.okta?.event_type)'
       allow_duplicates: false
+  - pipeline:
+      tag: pipeline_ecs_category_type
+      name: '{{ IngestPipeline "ecs_category_type" }}'
   - rename:
       field: json.uuid
       target_field: okta.uuid