[SIEM] Uses a dedicated index for job creation instead of the shared anomaly index

[FrankHassanabad]

Summary

Summarize your PR. If it involves visual changes include a screenshot or gif.

Checklist

Uses a dedicated index for job creation instead of the shared anomaly index.

Previously we used only .ml-anomalies-shared but this can cause a mapping clash from users who might have put different data types into that index already.

See:
https://www.elastic.co/guide/en/elastic-stack-overview/7.x/ml-mappingclash.html

This makes all creation of all SIEM jobs use a dedicated index from this point moving forward.

For testing:

• Delete any existing jobs from your server and any test data in the ML UI:
• Go to dev tools and run: GET /_cat/indices/.ml-anomalies-custom-*?v and verify you do not have any custom indexes prefixed with an existing SIEM job
• Click the "Anomaly Button" in the SIEM application to re-install the jobs
• Go to dev tools and run: GET /_cat/indices/.ml-*?v

Expectations are that you will see these indexes created:

health status index                                                          uuid                   pri rep docs.count docs.deleted store.size pri.store.size
green  open   .ml-anomalies-custom-siem-api-suspicious_login_activity_ecs    7ksvxOpgQ8WOG91NA_o8Eg   1   0       1474         1905    601.8kb        601.8kb
green  open   .ml-anomalies-custom-siem-api-rare_process_windows_ecs         Q_8xC5orR-eZSlXQJvmL9w   1   0       1655          474    454.3kb        454.3kb
green  open   .ml-anomalies-custom-siem-api-rare_process_linux_ecs           k_MwtbZIRbSkQxh6lcXIKg   1   0       1845         3832        1mb            1mb

- [ ] This was checked for cross-browser compatibility, including a check against IE11

• Any text added follows EUI's writing guidelines, uses sentence case text and includes i18n support

- [ ] Documentation was added for features that require explanation or tutorials

- [ ] Unit or functional tests were updated or added to match the most common scenarios

- [ ] This was checked for keyboard-only and screenreader accessibility

For maintainers

- [ ] This was checked for breaking API changes and was labeled appropriately

• This includes a feature addition or change that requires a release note and was labeled appropriately

[spong]

Checked out, tested locally, and verified the following:

• Both setup API calls /api/ml/modules/setup/siem_auditbeat_ecs & /api/ml/modules/setup/siem_winlogbeat_ecs now include useDedicatedIndex: true in the request payload
• That the dedicated indices exist after job creation:

green open .ml-anomalies-custom-siem-api-suspicious_login_activity_ecs ru8vhC_bT3Smf2b-G0eYfQ 1 0 0 0 230b 230b
green open .ml-anomalies-custom-siem-api-rare_process_windows_ecs      zDYUqYSiSVaNValzvsp-LQ 1 0 0 0 230b 230b
green open .ml-anomalies-custom-siem-api-rare_process_linux_ecs        5jVD96kWTymOl1Ye8EiKbw 1 0 0 0 230b 230b

• That the ml-anomalies-shared is no longer polluted with additional fields from the above jobs

LGTM! 👍

[elasticmachine]

💚 Build Succeeded

• continuous-integration/kibana-ci/pull-request