SECURITY-ENDPOINT: add more host properties to metadata and policy

[nnamdifrankie]

Summary

Issue:

#70201

• update generator and type to hold new fields.

{
          "@timestamp" : 1593452539763,
          "agent" : {
            "id" : "da16d6dd-9d6d-4711-90dc-b040c8035ff6",
            "version" : "1.0.0-local.20200416.0"
          },
          "elastic" : {
            "agent" : {
              "id" : "82dcace3-2be0-4155-abf2-fec19d2bb716"
            }
          },
          "ecs" : {
            "version" : "1.4.0"
          },
          "host" : {
            "id" : "743728ae-388d-40b2-8d98-6ca2dace27c1",
            "hostname" : "Host-why0jfi4w7",
            "name" : "Host-why0jfi4w7",
            "architecture" : "829lle6lhm",
            "ip" : [
              "10.25.175.177",
              "10.182.91.142",
              "10.228.55.210"
            ],
            "mac" : [
              "bd-8-87-3f-1a-cb",
              "5d-61-40-87-cb-62",
              "8-3d-f3-4a-3d-ad"
            ],
            "os" : {
              "name" : "windows 6.2",
              "full" : "Windows Server 2012",
              "version" : "6.2",
              "platform" : "Windows",
              "family" : "Windows",
              "Ext" : {
                "variant" : "Windows Server"
              }
            }
          },
          "Endpoint" : {
            "policy" : {
              "applied" : {
                "actions" : [
                  {
                    "name" : "configure_elasticsearch_connection",
                    "message" : "elasticsearch comes configured successfully",
                    "status" : "success"
                  },
                  {
                    "name" : "configure_kernel",
                    "message" : "Failed to configure kernel",
                    "status" : "failure"
                  },
                  {
                    "name" : "configure_logging",
                    "message" : "Successfully configured logging",
                    "status" : "success"
                  },
                  {
                    "name" : "configure_malware",
                    "message" : "Unexpected error configuring malware",
                    "status" : "failure"
                  },
                  {
                    "name" : "connect_kernel",
                    "message" : "Successfully initialized minifilter",
                    "status" : "success"
                  },
                  {
                    "name" : "detect_file_open_events",
                    "message" : "Successfully stopped file open event reporting",
                    "status" : "success"
                  },
                  {
                    "name" : "detect_file_write_events",
                    "message" : "Failed to stop file write event reporting",
                    "status" : "success"
                  },
                  {
                    "name" : "detect_image_load_events",
                    "message" : "Successfully started image load event reporting",
                    "status" : "success"
                  },
                  {
                    "name" : "detect_process_events",
                    "message" : "Successfully started process event reporting",
                    "status" : "success"
                  },
                  {
                    "name" : "download_global_artifacts",
                    "message" : "Failed to download EXE model",
                    "status" : "success"
                  },
                  {
                    "name" : "load_config",
                    "message" : "Successfully parsed configuration",
                    "status" : "success"
                  },
                  {
                    "name" : "load_malware_model",
                    "message" : "Error deserializing EXE model; no valid malware model installed",
                    "status" : "success"
                  },
                  {
                    "name" : "read_elasticsearch_config",
                    "message" : "Successfully read Elasticsearch configuration",
                    "status" : "success"
                  },
                  {
                    "name" : "read_events_config",
                    "message" : "Successfully read events configuration",
                    "status" : "success"
                  },
                  {
                    "name" : "read_kernel_config",
                    "message" : "Succesfully read kernel configuration",
                    "status" : "success"
                  },
                  {
                    "name" : "read_logging_config",
                    "message" : "Field (logging.debugview) not found in config",
                    "status" : "success"
                  },
                  {
                    "name" : "read_malware_config",
                    "message" : "Successfully read malware detect configuration",
                    "status" : "success"
                  },
                  {
                    "name" : "workflow",
                    "message" : "Failed to apply a portion of the configuration (kernel)",
                    "status" : "success"
                  },
                  {
                    "name" : "download_model",
                    "message" : "Failed to apply a portion of the configuration (kernel)",
                    "status" : "success"
                  },
                  {
                    "name" : "ingest_events_config",
                    "message" : "Failed to apply a portion of the configuration (kernel)",
                    "status" : "success"
                  }
                ],
                "id" : "C2A9093E-E289-4C0A-AA44-8C32A414FA7A",
                "response" : {
                  "configurations" : {
                    "events" : {
                      "concerned_actions" : [
                        "download_model"
                      ],
                      "status" : "warning"
                    },
                    "logging" : {
                      "concerned_actions" : [
                        "load_config"
                      ],
                      "status" : "success"
                    },
                    "malware" : {
                      "concerned_actions" : [
                        "load_config"
                      ],
                      "status" : "failure"
                    },
                    "streaming" : {
                      "concerned_actions" : [
                        "workflow",
                        "connect_kernel"
                      ],
                      "status" : "warning"
                    }
                  }
                },
                "artifacts" : {
                  "global" : {
                    "version" : "1.4.0",
                    "identifiers" : [
                      {
                        "name" : "endpointpe-model",
                        "sha256" : "e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855"
                      }
                    ]
                  },
                  "user" : {
                    "version" : "1.4.0",
                    "identifiers" : [
                      {
                        "name" : "user-model",
                        "sha256" : "e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855"
                      }
                    ]
                  }
                },
                "status" : "success",
                "version" : "734806ca-bd98-4b22-937b-2b8339737cc0",
                "name" : "With Eventing"
              }
            }
          },
          "event" : {
            "created" : 1593452539763,
            "id" : "af95c838-eb08-4dcf-82e4-29d3ea209638",
            "kind" : "state",
            "category" : "host",
            "type" : "change",
            "module" : "endpoint",
            "action" : "endpoint_policy_response",
            "dataset" : "endpoint.policy"
          }
        }

{
            "created" : 1593452539763
          },
          "agent" : {
            "version" : "6.3.7",
            "id" : "da16d6dd-9d6d-4711-90dc-b040c8035ff6",
            "type" : "endpoint"
          },
          "elastic" : {
            "agent" : {
              "id" : "82dcace3-2be0-4155-abf2-fec19d2bb716"
            }
          },
          "host" : {
            "id" : "743728ae-388d-40b2-8d98-6ca2dace27c1",
            "hostname" : "Host-why0jfi4w7",
            "name" : "Host-why0jfi4w7",
            "architecture" : "829lle6lhm",
            "ip" : [
              "10.25.175.177",
              "10.182.91.142",
              "10.228.55.210"
            ],
            "mac" : [
              "bd-8-87-3f-1a-cb",
              "5d-61-40-87-cb-62",
              "8-3d-f3-4a-3d-ad"
            ],
            "os" : {
              "name" : "windows 6.2",
              "full" : "Windows Server 2012",
              "version" : "6.2",
              "platform" : "Windows",
              "family" : "Windows",
              "Ext" : {
                "variant" : "Windows Server"
              }
            }
          },
          "Endpoint" : {
            "status" : "enrolled",
            "policy" : {
              "applied" : {
                "name" : "With Eventing",
                "id" : "C2A9093E-E289-4C0A-AA44-8C32A414FA7A",
                "status" : "success"
              }
            }
          }
        }

Checklist

Delete any items that are not applicable to this PR.

• Unit or functional tests were updated or added to match the most common scenarios

[kibanamachine]

💚 Build Succeeded

• continuous-integration/kibana-ci/pull-request
• Commit: e543b65

Build metrics

✅ unchanged

To update your PR or re-run it, just comment with:
@elasticmachine merge upstream

[elasticmachine]

Pinging @elastic/siem (Team:SIEM)

[elasticmachine]

Pinging @elastic/security-solution (Team: SecuritySolution)