[mimecast] audit events - add additional email fields

[djordje-adzemovic-devtech]

What does this PR do?

Add new use case in pipeline for audit events, set email.direction as lowercase, set geo.ip for siem logs and for ttp-url logs email.to.adress and remove user data

Checklist

• I have reviewed tips for building integrations and this pull request is aligned with them.
• I have verified that all data streams collect metrics or logs.
• I have added an entry to my package's changelog.yml file.
• I have verified that Kibana version constraints are current according to guidelines.

[elasticmachine]

❕ Build Aborted

The PR is not allowed to run in the CI yet

the below badges are clickable and redirect to their specific view in the CI or DOCS

Expand to view the summary

Build stats

• Start Time: 2022-04-10T21:37:18.604+0000

• Duration: 2 min 12 sec

Steps errors

Expand to view the steps failures

Google Storage Download

• Took 0 min 0 sec . View more details here

🤖 GitHub comments

To re-run your PR in the CI, just comment with:

• /test : Re-trigger the build.

[elasticmachine]

Pinging @elastic/security-external-integrations (Team:Security-External Integrations)

[andrewkroh]

This will need to be updated after #2841 is merged as it includes some of the same commits.

[andrewkroh]

@djordje-adzemovic-devtech You can rebase this on main now that the other PR is merged.

[djordje-adzemovic-devtech]

I will close this PR I made a new one since rebase cause a lot of conflicts which are hard to resolve.

[djordje-adzemovic-devtech]

I will close this PR since rebase cause a lot of conflicts which are hard to resolve.

[djordje-adzemovic-devtech]

This is new PR:
#3116