Map ocsf.src_endpoint.uid in DNS Activity [4003] pipelines

[jbfeldman-dd]

What does this PR do?

Populates ocsf.src_endpoint.uid in every DNS Activity [4003] sub pipeline in this repo.

Where the source events carry a client device identifier, that field is mapped:

Integration	Source field
cisco_umbrella_dns	identities.0.id — the Umbrella identity that issued the query

Where no client device identifier exists in the DNS sample logs, ocsf.src_endpoint.ip is mapped instead:

Integration	Why there is no device ID
bluecat_integrity	sourceId / serverId identify the BlueCat appliance and are already mapped to ocsf.dst_endpoint.uid
coredns	The grok-parsed log line carries only client IP and port
zeek	uid is a per-connection identifier, not a device identifier

dnsfilter already maps agentid to ocsf.src_endpoint.uid, so it is unchanged.

Expected results in the _tests.yaml files were updated in alphabetical key order to match the repository's deepSort convention.

Motivation

ocsf.src_endpoint.uid was unpopulated across most DNS Activity pipelines, so DNS events could not be correlated to a source device by ID. Filling it consistently — with a device ID where one exists and the source IP as a stable fallback where one does not — gives every 4003 event a source endpoint identifier.

Review checklist (to be filled by reviewers)

• Feature or bugfix MUST have appropriate tests (unit, integration, e2e)
• Add qa/required if this PR needs QA validation, or qa/skip-qa if it does not. Exactly one of the two is required.
• If you need to backport this PR to another branch, you can add the backport/<branch-name> label to the PR and it will automatically open a backport PR once this one is merged

[cit-pr-commenter-54b7da]

evalya-impact-summary

evalya impact analysis

Impact analysis: 0 selected, 0 skipped (of 0 test tasks)
Publish tasks:   1 (always emitted)
Diff (8 files):
  bluecat_integrity/assets/logs/bluecat-integrity.yaml
  bluecat_integrity/assets/logs/bluecat-integrity_tests.yaml
  cisco_umbrella_dns/assets/logs/cisco-umbrella-dns.yaml
  cisco_umbrella_dns/assets/logs/cisco-umbrella-dns_tests.yaml
  coredns/assets/logs/coredns.yaml
  coredns/assets/logs/coredns_tests.yaml
  zeek/assets/logs/zeek.yaml
  zeek/assets/logs/zeek_tests.yaml

Debug a specific task: evalya plan impact --path <path> --task <task>

Learn more about CI impact filtering

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 979a137637

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[dd-octo-sts]

Validation Report

All 21 validations passed.

Show details

Validation	Description	Status
agent-reqs	Verify check versions match the Agent requirements file	✅
ci	Validate CI configuration and code coverage settings	✅
codeowners	Validate every integration has a CODEOWNERS entry	✅
config	Validate default configuration files against spec.yaml	✅
dep	Verify dependency pins are consistent and Agent-compatible	✅
http	Validate integrations use the HTTP wrapper correctly	✅
imports	Validate check imports do not use deprecated modules	✅
integration-style	Validate check code style conventions	✅
jmx-metrics	Validate JMX metrics definition files and config	✅
labeler	Validate PR labeler config matches integration directories	✅
legacy-signature	Validate no integration uses the legacy Agent check signature	✅
license-headers	Validate Python files have proper license headers	✅
licenses	Validate third-party license attribution list	✅
metadata	Validate metadata.csv metric definitions	✅
models	Validate configuration data models match spec.yaml	✅
openmetrics	Validate OpenMetrics integrations disable the metric limit	✅
package	Validate Python package metadata and naming	✅
qa-label	Validate the pull request declares whether it needs QA for the next Agent release	✅
readmes	Validate README files have required sections	✅
saved-views	Validate saved view JSON file structure and fields	✅
version	Validate version consistency between package and changelog	✅

View full run